diff --git a/doc/hooks/waf.section.md b/doc/hooks/waf.section.md
index 8dc78121cd9d..fa027d87a94d 100644
--- a/doc/hooks/waf.section.md
+++ b/doc/hooks/waf.section.md
@@ -1,50 +1,58 @@
-# waf.hook {#wafhook}
+# wafHook {#waf-hook}
 
 [Waf](https://waf.io) is a Python-based software building system.
 
-In Nixpkgs, `waf.hook` overrides the default configure, build, and install phases.
+In Nixpkgs, `wafHook` overrides the default configure, build, and install phases.
 
-## Variables controlling waf.hook {#variablesControllingWafHook}
+## Variables controlling wafHook {#waf-hook-variables-controlling}
 
-### `wafPath` {#wafPath}
+### `wafHook` Exclusive Variables {#waf-hook-exclusive-variables}
+
+The variables below are exclusive of `wafHook`.
+
+#### `wafPath` {#waf-path}
 
 Location of the `waf` tool. It defaults to `./waf`, to honor software projects that include it directly inside their source trees.
 
-If `wafPath` doesn't exist, then `waf.hook` will copy the `waf` provided from Nixpkgs to it.
+If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nixpkgs to it.
 
-### `wafConfigureFlags` {#wafConfigureFlags}
+#### `wafFlags` {#waf-flags}
 
-Controls the flags passed to waf tool during configure phase.
+Controls the flags passed to waf tool during build and install phases. For settings specific to build or install phases, use `wafBuildFlags` or `wafInstallFlags` respectively.
 
-### `wafFlags` {#wafFlags}
-
-Controls the flags passed to waf tool during build and install phases.
-
-### `dontAddWafCrossFlags` {#dontAddWafCrossFlags}
+#### `dontAddWafCrossFlags` {#dont-add-waf-cross-flags}
 
 When set to `true`, don't add cross compilation flags during configure phase.
 
-### `dontUseWafConfigure` {#dontUseWafConfigure}
+#### `dontUseWafConfigure` {#dont-use-waf-configure}
 
 When set to true, don't use the predefined `wafConfigurePhase`.
 
-### `dontUseWafBuild` {#dontUseWafBuild}
+#### `dontUseWafBuild` {#dont-use-waf-build}
 
 When set to true, don't use the predefined `wafBuildPhase`.
 
-### `dontUseWafInstall` {#dontUseWafInstall}
+#### `dontUseWafInstall` {#dont-use-waf-install}
 
 When set to true, don't use the predefined `wafInstallPhase`.
 
-### Variables honored by waf.hook {#variablesHonoredByWafHook}
+### Similar variables {#waf-hook-similar-variables}
 
-The following variables commonly used by `stdenv.mkDerivation` are also honored by `waf.hook`.
+The following variables are similar to their `stdenv.mkDerivation` counterparts.
+
+| `wafHook` Variable    | `stdenv.mkDerivation` Counterpart |
+|-----------------------|-----------------------------------|
+| `wafConfigureFlags`   | `configureFlags`                  |
+| `wafConfigureTargets` | `configureTargets`                |
+| `wafBuildFlags`       | `buildFlags`                      |
+| `wafBuildTargets`     | `buildTargets`                    |
+| `wafInstallFlags`     | `installFlags`                    |
+| `wafInstallTargets`   | `installTargets`                  |
+
+### Honored variables {#waf-hook-honored-variables}
+
+The following variables commonly used by `stdenv.mkDerivation` are honored by `wafHook`.
 
 - `prefixKey`
-- `configureTargets`
 - `enableParallelBuilding`
 - `enableParallelInstalling`
-- `buildFlags`
-- `buildTargets`
-- `installFlags`
-- `installTargets`
diff --git a/doc/hooks/zig.section.md b/doc/hooks/zig.section.md
index 8178866f44c9..1a09491649d7 100644
--- a/doc/hooks/zig.section.md
+++ b/doc/hooks/zig.section.md
@@ -4,7 +4,7 @@
 
 In Nixpkgs, `zig.hook` overrides the default build, check and install phases.
 
-## Example code snippet {#example-code-snippet}
+## Example code snippet {#zig-hook-example-code-snippet}
 
 ```nix
 { lib
@@ -27,25 +27,25 @@ stdenv.mkDerivation {
 }
 ```
 
-## Variables controlling zig.hook {#variables-controlling-zig-hook}
+## Variables controlling zig.hook {#zig-hook-variables-controlling}
 
-### `zig.hook` Exclusive Variables {#zigHookExclusiveVariables}
+### `zig.hook` Exclusive Variables {#zig-hook-exclusive-variables}
 
 The variables below are exclusive to `zig.hook`.
 
-#### `dontUseZigBuild` {#dontUseZigBuild}
+#### `dontUseZigBuild` {#dont-use-zig-build}
 
 Disables using `zigBuildPhase`.
 
-#### `dontUseZigCheck` {#dontUseZigCheck}
+#### `dontUseZigCheck` {#dont-use-zig-check}
 
 Disables using `zigCheckPhase`.
 
-#### `dontUseZigInstall` {#dontUseZigInstall}
+#### `dontUseZigInstall` {#dont-use-zig-install}
 
 Disables using `zigInstallPhase`.
 
-### Similar variables {#similarVariables}
+### Similar variables {#zig-hook-similar-variables}
 
 The following variables are similar to their `stdenv.mkDerivation` counterparts.
 
@@ -55,7 +55,7 @@ The following variables are similar to their `stdenv.mkDerivation` counterparts.
 | `zigCheckFlags`     | `checkFlags`                      |
 | `zigInstallFlags`   | `installFlags`                    |
 
-### Variables honored by zig.hook {#variables-honored-by-zig-hook}
+### Variables honored by zig.hook {#zig-hook-variables-honored}
 
 The following variables commonly used by `stdenv.mkDerivation` are honored by `zig.hook`.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 77c6562377b0..33043a777594 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8297,6 +8297,12 @@
     githubId = 297653;
     name = "Joe Salisbury";
   };
+  johannwagner = {
+    email = "nix@wagner.digital";
+    github = "johannwagner";
+    githubId = 12380026;
+    name = "Johann Wagner";
+  };
   johanot = {
     email = "write@ownrisk.dk";
     github = "johanot";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 01b29e32cb9d..8e92004148ba 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -294,6 +294,17 @@ with lib.maintainers; {
     githubTeams = [ "flutter" ];
   };
 
+  flyingcircus = {
+    # Verify additions by approval of an already existing member of the team.
+    members = [
+      theuni
+      dpausp
+      leona
+    ];
+    scope = "Team for Flying Circus employees who collectively maintain packages.";
+    shortName = "Flying Circus employees";
+  };
+
   freedesktop = {
     members = [ jtojnar ];
     scope = "Maintain Freedesktop.org packages for graphical desktop.";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 921fe3c5cb79..b9f1c814cd5a 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -8,6 +8,8 @@
 
 - LXD now supports virtual machine instances to complement the existing container support
 
+- The `nixos-rebuild` command has been given a `list-generations` subcommand. See `man nixos-rebuild` for more details.
+
 ## New Services {#sec-release-23.11-new-services}
 
 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@@ -290,3 +292,5 @@ The module update takes care of the new config syntax and the data itself (user
   ./common/auto-format-root-device.nix ];` When you use the systemd initrd, you
   can automatically format the root device by setting
   `virtualisation.fileSystems."/".autoFormat = true;`.
+
+- The `electron` packages now places its application files in `$out/libexec/electron` instead of `$out/lib/electron`. Packages using electron-builder will fail to build and need to be adjusted by changing `lib` to `libexec`.
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 12255d8392fe..ad65f80bb2ca 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -5,8 +5,8 @@ let
 
   parentWrapperDir = dirOf wrapperDir;
 
-  securityWrapper = pkgs.callPackage ./wrapper.nix {
-    inherit parentWrapperDir;
+  securityWrapper = sourceProg : pkgs.callPackage ./wrapper.nix {
+    inherit sourceProg;
   };
 
   fileModeType =
@@ -91,8 +91,7 @@ let
     , ...
     }:
     ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
 
       # Prevent races
       chmod 0000 "$wrapperDir/${program}"
@@ -119,8 +118,7 @@ let
     , ...
     }:
     ''
-      cp ${securityWrapper}/bin/security-wrapper "$wrapperDir/${program}"
-      echo -n "${source}" > "$wrapperDir/${program}.real"
+      cp ${securityWrapper source}/bin/security-wrapper "$wrapperDir/${program}"
 
       # Prevent races
       chmod 0000 "$wrapperDir/${program}"
@@ -248,11 +246,13 @@ in
       export PATH="${wrapperDir}:$PATH"
     '';
 
-    security.apparmor.includes."nixos/security.wrappers" = ''
-      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers"; } [
-        securityWrapper
+    security.apparmor.includes = lib.mapAttrs' (wrapName: wrap: lib.nameValuePair
+     "nixos/security.wrappers/${wrapName}" ''
+      include "${pkgs.apparmorRulesFromClosure { name="security.wrappers.${wrapName}"; } [
+        (securityWrapper wrap.source)
       ]}"
-    '';
+      mrpx ${wrap.source},
+    '') wrappers;
 
     ###### wrappers activation script
     system.activationScripts.wrappers =
diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c
index 17776a97af81..2cf1727a31c8 100644
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@@ -17,6 +17,10 @@
 #include <syscall.h>
 #include <byteswap.h>
 
+#ifndef SOURCE_PROG
+#error SOURCE_PROG should be defined via preprocessor commandline
+#endif
+
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
 // aborts when returns non-zero, printing the failed expression and errno
@@ -24,10 +28,6 @@
 
 extern char **environ;
 
-// The WRAPPER_DIR macro is supplied at compile time so that it cannot
-// be changed at runtime
-static char *wrapper_dir = WRAPPER_DIR;
-
 // Wrapper debug variable name
 static char *wrapper_debug = "WRAPPER_DEBUG";
 
@@ -151,115 +151,20 @@ static int make_caps_ambient(const char *self_path) {
     return 0;
 }
 
-int readlink_malloc(const char *p, char **ret) {
-    size_t l = FILENAME_MAX+1;
-    int r;
-
-    for (;;) {
-        char *c = calloc(l, sizeof(char));
-        if (!c) {
-            return -ENOMEM;
-        }
-
-        ssize_t n = readlink(p, c, l-1);
-        if (n < 0) {
-            r = -errno;
-            free(c);
-            return r;
-        }
-
-        if ((size_t) n < l-1) {
-            c[n] = 0;
-            *ret = c;
-            return 0;
-        }
-
-        free(c);
-        l *= 2;
-    }
-}
-
 int main(int argc, char **argv) {
     ASSERT(argc >= 1);
-    char *self_path = NULL;
-    int self_path_size = readlink_malloc("/proc/self/exe", &self_path);
-    if (self_path_size < 0) {
-        fprintf(stderr, "cannot readlink /proc/self/exe: %s", strerror(-self_path_size));
-    }
-
-    unsigned int ruid, euid, suid, rgid, egid, sgid;
-    MUSTSUCCEED(getresuid(&ruid, &euid, &suid));
-    MUSTSUCCEED(getresgid(&rgid, &egid, &sgid));
-
-    // If true, then we did not benefit from setuid privilege escalation,
-    // where the original uid is still in ruid and different from euid == suid.
-    int didnt_suid = (ruid == euid) && (euid == suid);
-    // If true, then we did not benefit from setgid privilege escalation
-    int didnt_sgid = (rgid == egid) && (egid == sgid);
-
-
-    // Make sure that we are being executed from the right location,
-    // i.e., `safe_wrapper_dir'.  This is to prevent someone from creating
-    // hard link `X' from some other location, along with a false
-    // `X.real' file, to allow arbitrary programs from being executed
-    // with elevated capabilities.
-    int len = strlen(wrapper_dir);
-    if (len > 0 && '/' == wrapper_dir[len - 1])
-      --len;
-    ASSERT(!strncmp(self_path, wrapper_dir, len));
-    ASSERT('/' == wrapper_dir[0]);
-    ASSERT('/' == self_path[len]);
-
-    // If we got privileges with the fs set[ug]id bit, check that the privilege we
-    // got matches the one one we expected, ie that our effective uid/gid
-    // matches the uid/gid of `self_path`. This ensures that we were executed as
-    // `self_path', and not, say, as some other setuid program.
-    // We don't check that if we did not benefit from the set[ug]id bit, as
-    // can be the case in nosuid mounts or user namespaces.
-    struct stat st;
-    ASSERT(lstat(self_path, &st) != -1);
-
-    // if the wrapper gained privilege with suid, check that we got the uid of the file owner
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == euid));
-    // if the wrapper gained privilege with sgid, check that we got the gid of the file group
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == egid));
-    // same, but with suid instead of euid
-    ASSERT(!((st.st_mode & S_ISUID) && !didnt_suid) || (st.st_uid == suid));
-    ASSERT(!((st.st_mode & S_ISGID) && !didnt_sgid) || (st.st_gid == sgid));
-
-    // And, of course, we shouldn't be writable.
-    ASSERT(!(st.st_mode & (S_IWGRP | S_IWOTH)));
-
-    // Read the path of the real (wrapped) program from <self>.real.
-    char real_fn[PATH_MAX + 10];
-    int real_fn_size = snprintf(real_fn, sizeof(real_fn), "%s.real", self_path);
-    ASSERT(real_fn_size < sizeof(real_fn));
-
-    int fd_self = open(real_fn, O_RDONLY);
-    ASSERT(fd_self != -1);
-
-    char source_prog[PATH_MAX];
-    len = read(fd_self, source_prog, PATH_MAX);
-    ASSERT(len != -1);
-    ASSERT(len < sizeof(source_prog));
-    ASSERT(len > 0);
-    source_prog[len] = 0;
-
-    close(fd_self);
 
     // Read the capabilities set on the wrapper and raise them in to
     // the ambient set so the program we're wrapping receives the
     // capabilities too!
-    if (make_caps_ambient(self_path) != 0) {
-        free(self_path);
+    if (make_caps_ambient("/proc/self/exe") != 0) {
         return 1;
     }
-    free(self_path);
 
-    execve(source_prog, argv, environ);
+    execve(SOURCE_PROG, argv, environ);
     
     fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], source_prog, strerror(errno));
+        argv[0], SOURCE_PROG, strerror(errno));
 
     return 1;
 }
diff --git a/nixos/modules/security/wrappers/wrapper.nix b/nixos/modules/security/wrappers/wrapper.nix
index e3620fb222d2..aec43412404e 100644
--- a/nixos/modules/security/wrappers/wrapper.nix
+++ b/nixos/modules/security/wrappers/wrapper.nix
@@ -1,4 +1,4 @@
-{ stdenv, linuxHeaders, parentWrapperDir, debug ? false }:
+{ stdenv, linuxHeaders, sourceProg, debug ? false }:
 # For testing:
 # $ nix-build -E 'with import <nixpkgs> {}; pkgs.callPackage ./wrapper.nix { parentWrapperDir = "/run/wrappers"; debug = true; }'
 stdenv.mkDerivation {
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   dontUnpack = true;
   hardeningEnable = [ "pie" ];
   CFLAGS = [
-    ''-DWRAPPER_DIR="${parentWrapperDir}"''
+    ''-DSOURCE_PROG="${sourceProg}"''
   ] ++ (if debug then [
     "-Werror" "-Og" "-g"
   ] else [
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index 747b85f94c65..81fed8a0b99a 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -186,7 +186,7 @@ in
           ProtectSystem = "strict";
           ReadWritePaths = cfg.recordingsDir;
           RemoveIPC = true;
-          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" ];
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 756632a45f90..87afc5023253 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -2814,9 +2814,8 @@ let
 
       systemd.services.systemd-networkd = let
         isReloadableUnitFileName = unitFileName: strings.hasSuffix ".network" unitFileName;
-        partitionedUnitFiles = lib.partition isReloadableUnitFileName unitFiles;
-        reloadableUnitFiles = partitionedUnitFiles.right;
-        nonReloadableUnitFiles = partitionedUnitFiles.wrong;
+        reloadableUnitFiles = attrsets.filterAttrs (k: v: isReloadableUnitFileName k) unitFiles;
+        nonReloadableUnitFiles = attrsets.filterAttrs (k: v: !isReloadableUnitFileName k) unitFiles;
         unitFileSources = unitFiles: map (x: x.source) (attrValues unitFiles);
       in {
         wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index ac55461107fb..b6c3085c4f16 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -395,7 +395,9 @@ in
       description = lib.mdDoc ''
         The amount of time which can elapse after a reboot has been triggered
         before a watchdog hardware device will automatically reboot the system.
-        Valid time units include "ms", "s", "min", "h", "d", and "w".
+        Valid time units include "ms", "s", "min", "h", "d", and "w". If left
+        `null`, systemd will use its default of `10min`; see also {command}`man
+        5 systemd-system.conf`.
       '';
     };
 
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index eb1c7512d920..0d4033ca9430 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1396,14 +1396,12 @@ in
     security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
       /run/wrappers/bin/ping {
         include <abstractions/base>
-        include <nixos/security.wrappers>
+        include <nixos/security.wrappers/ping>
         rpx /run/wrappers/wrappers.*/ping,
       }
       /run/wrappers/wrappers.*/ping {
         include <abstractions/base>
-        include <nixos/security.wrappers>
-        r /run/wrappers/wrappers.*/ping.real,
-        mrpx ${config.security.wrappers.ping.source},
+        include <nixos/security.wrappers/ping>
         capability net_raw,
         capability setpcap,
       }
diff --git a/nixos/modules/tasks/swraid.nix b/nixos/modules/tasks/swraid.nix
index f624294565b0..8985660d80a7 100644
--- a/nixos/modules/tasks/swraid.nix
+++ b/nixos/modules/tasks/swraid.nix
@@ -2,6 +2,8 @@
 
   cfg = config.boot.swraid;
 
+  mdadm_conf = config.environment.etc."mdadm.conf";
+
 in {
   imports = [
     (lib.mkRenamedOptionModule [ "boot" "initrd" "services" "swraid" "enable" ] [ "boot" "swraid" "enable" ])
@@ -36,8 +38,14 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    warnings = lib.mkIf
+        ((builtins.match ".*(MAILADDR|PROGRAM).*" mdadm_conf.text) == null)
+        [ "mdadm: Neither MAILADDR nor PROGRAM has been set. This will cause the `mdmon` service to crash." ];
+
     environment.systemPackages = [ pkgs.mdadm ];
 
+    environment.etc."mdadm.conf".text = lib.mkAfter cfg.mdadmConf;
+
     services.udev.packages = [ pkgs.mdadm ];
 
     systemd.packages = [ pkgs.mdadm ];
@@ -59,12 +67,10 @@ in {
         $out/bin/mdadm --version
       '';
 
-      extraFiles."/etc/mdadm.conf".source = pkgs.writeText "mdadm.conf" config.boot.swraid.mdadmConf;
+      extraFiles."/etc/mdadm.conf" = mdadm_conf;
 
       systemd = {
-        contents."/etc/mdadm.conf" = lib.mkIf (cfg.mdadmConf != "") {
-          text = cfg.mdadmConf;
-        };
+        contents."/etc/mdadm.conf".text = mdadm_conf.text;
 
         packages = [ pkgs.mdadm ];
         initrdBin = [ pkgs.mdadm ];
diff --git a/nixos/tests/systemd-initrd-swraid.nix b/nixos/tests/systemd-initrd-swraid.nix
index d87170c92574..cb5b1cb4f535 100644
--- a/nixos/tests/systemd-initrd-swraid.nix
+++ b/nixos/tests/systemd-initrd-swraid.nix
@@ -20,6 +20,9 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
         ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
       '';
     };
+    environment.etc."mdadm.conf".text = ''
+      MAILADDR test@example.com
+    '';
     boot.initrd = {
       systemd = {
         enable = true;
@@ -33,7 +36,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
 
   testScript = ''
     # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid0 /dev/vdb /dev/vdc")
+    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90")
     machine.succeed("mkfs.ext4 -L testraid /dev/md0")
     machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 
@@ -48,5 +51,13 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
     assert "/dev/md0 on / type ext4" in machine.succeed("mount")
     assert "hello" in machine.succeed("cat /test")
     assert "md0" in machine.succeed("cat /proc/mdstat")
+
+    expected_config = """MAILADDR test@example.com
+
+    ARRAY /dev/md0 devices=/dev/vdb,/dev/vdc
+    """
+    got_config = machine.execute("cat /etc/mdadm.conf")[1]
+    assert expected_config == got_config, repr((expected_config, got_config))
+    machine.wait_for_unit("mdmonitor.service")
   '';
 })
diff --git a/nixos/tests/wrappers.nix b/nixos/tests/wrappers.nix
index 391e9b42b45b..1d4fa85d7399 100644
--- a/nixos/tests/wrappers.nix
+++ b/nixos/tests/wrappers.nix
@@ -21,6 +21,8 @@ in
       };
     };
 
+    security.apparmor.enable = true;
+
     security.wrappers = {
       suidRoot = {
         owner = "root";
@@ -84,17 +86,27 @@ in
       test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -g', '0')
       test_as_regular_in_userns_mapped_as_root('/run/wrappers/bin/sgid_root_busybox id -rg', '0')
 
+      # Test that in nonewprivs environment the wrappers simply exec their target.
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/suid_root_busybox id -rg', '${toString usersGid}')
+
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -u', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -ru', '${toString userUid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -g', '${toString usersGid}')
+      test_as_regular('${pkgs.util-linux}/bin/setpriv --no-new-privs /run/wrappers/bin/sgid_root_busybox id -rg', '${toString usersGid}')
+
       # We are only testing the permitted set, because it's easiest to look at with capsh.
       machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_CHOWN'))
       machine.fail(cmd_as_regular('${pkgs.libcap}/bin/capsh --has-p=CAP_SYS_ADMIN'))
       machine.succeed(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_CHOWN'))
       machine.fail(cmd_as_regular('/run/wrappers/bin/capsh_with_chown --has-p=CAP_SYS_ADMIN'))
 
-      # test a few "attacks" against which the wrapper protects itself
-      machine.succeed("cp /run/wrappers/bin/suid_root_busybox{,.real} /tmp/")
-      machine.fail(cmd_as_regular("/tmp/suid_root_busybox id -u"))
-
-      machine.succeed("chmod u+s,a+w /run/wrappers/bin/suid_root_busybox")
-      machine.fail(cmd_as_regular("/run/wrappers/bin/suid_root_busybox id -u"))
+      # Test that the only user of apparmor policy includes generated by
+      # wrappers works. Ideally this'd be located in a test for the module that
+      # actually makes the apparmor policy for ping, but there's no convenient
+      # test for that one.
+      machine.succeed("ping -c 1 127.0.0.1")
     '';
 })
diff --git a/pkgs/applications/audio/spotify-player/default.nix b/pkgs/applications/audio/spotify-player/default.nix
index cd2d050c9a96..4bf9380e3568 100644
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals withSixel [ libsixel ]
     ++ lib.optionals (withAudioBackend == "alsa") [ alsa-lib ]
     ++ lib.optionals (withAudioBackend == "pulseaudio") [ libpulseaudio ]
-    ++ lib.optionals (withAudioBackend == "rodio") [ alsa-lib ]
+    ++ lib.optionals (withAudioBackend == "rodio" && stdenv.isLinux) [ alsa-lib ]
     ++ lib.optionals (withAudioBackend == "portaudio") [ portaudio ]
     ++ lib.optionals (withAudioBackend == "jackaudio") [ libjack2 ]
     ++ lib.optionals (withAudioBackend == "rodiojack") [ alsa-lib libjack2 ]
diff --git a/pkgs/applications/blockchains/btcpayserver/default.nix b/pkgs/applications/blockchains/btcpayserver/default.nix
index 1802c7cf8969..afb8547afc17 100644
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.11.3";
+  version = "1.11.4";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fs8GAE/beiFLUNBI+r8h08a2TYSY9fYQYGvxBOtClgg=";
+    sha256 = "sha256-PJhc+Kv/iZ73DkM9KXzujTsIc071wqn/NKhuUPs/7dA=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 94ed3d87ba8e..9c69a4bebff0 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
     yarn --offline run electron-builder --dir \
       --config electron-builder-linux-mac.json \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/applications/misc/OSCAR/default.nix b/pkgs/applications/misc/OSCAR/default.nix
index 3d8ea9119544..fee0c79cd5d9 100644
--- a/pkgs/applications/misc/OSCAR/default.nix
+++ b/pkgs/applications/misc/OSCAR/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, mkDerivation, fetchFromGitLab, qmake, qtbase, qttools, qtserialport, libGLU }:
 mkDerivation rec {
   pname = "OSCAR";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     owner = "pholy";
     repo = "OSCAR-code";
     rev = "v${version}";
-    sha256 = "sha256-bgETkpyL0yhCD1FfTVN0s9RNOPkDp88W/1Gdxvu+Ons=";
+    sha256 = "sha256-eaj2/ioh9dXxWv7X/IZv7m/oVcU6t7r+mK5YrrViF2w=";
   };
 
   buildInputs = [ qtbase qttools qtserialport libGLU ];
diff --git a/pkgs/applications/misc/authy/default.nix b/pkgs/applications/misc/authy/default.nix
index 199e89dc0ba5..95a439b67539 100644
--- a/pkgs/applications/misc/authy/default.nix
+++ b/pkgs/applications/misc/authy/default.nix
@@ -10,12 +10,12 @@
 stdenv.mkDerivation rec {
   pname = "authy";
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/authy?channel=stable' | jq '.download_url,.version'
-  version = "2.3.0";
-  rev = "19";
+  version = "2.4.1";
+  rev = "21";
 
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/H8ZpNgIoPyvmkgxOWw5MSzsXK1wRZiHn_${rev}.snap";
-    hash = "sha256-WN/vcY3kfF/HQZ7opyIdDevU5oDYDGjshS7XVU7yrj8=";
+    hash = "sha256-a5z6Lwdgody88f7has/f2AMg9m9fGWsJSexZM6KUGOY=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper squashfsTools ];
diff --git a/pkgs/applications/misc/kuro/default.nix b/pkgs/applications/misc/kuro/default.nix
index 26c8d6bbf11b..50a773b5c518 100644
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@@ -38,7 +38,7 @@ mkYarnPackage rec {
 
     yarn --offline run electron-builder \
       --dir \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
     popd
diff --git a/pkgs/applications/misc/nwg-look/default.nix b/pkgs/applications/misc/nwg-look/default.nix
index 21b5a7a83324..864e94d4e07f 100644
--- a/pkgs/applications/misc/nwg-look/default.nix
+++ b/pkgs/applications/misc/nwg-look/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
-    repo = pname;
+    repo = "nwg-look";
     rev = "v${version}";
     hash = "sha256-wUI58qYkVYgES87HQ4octciDlOJ10oJldbUkFgxRUd4=";
   };
diff --git a/pkgs/applications/misc/pot/Cargo.lock b/pkgs/applications/misc/pot/Cargo.lock
index 58f2b5332d26..9e2076047a94 100644
--- a/pkgs/applications/misc/pot/Cargo.lock
+++ b/pkgs/applications/misc/pot/Cargo.lock
@@ -65,6 +65,12 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
+
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -257,6 +263,15 @@ dependencies = [
  "system-deps 6.1.1",
 ]
 
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.1"
@@ -330,6 +345,9 @@ name = "bitflags"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "block"
@@ -679,6 +697,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
+
 [[package]]
 name = "const-random"
 version = "0.1.15"
@@ -775,6 +799,21 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86ec7a15cbe22e59248fc7eadb1907dab5ba09372595da4d73dd805ed4417dfe"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cace84e55f07e7301bae1c519df89cdad8cc3cd868413d3fdbdeca9ff3db484"
+
 [[package]]
 name = "crc32fast"
 version = "1.3.2"
@@ -818,6 +857,16 @@ dependencies = [
  "scopeguard",
 ]
 
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.16"
@@ -926,6 +975,17 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "der"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fffa369a668c8af7dbf8b5e56c9f744fbd399949ed171606040001947de40b1c"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.3.8"
@@ -977,6 +1037,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
+ "const-oid",
  "crypto-common",
  "subtle",
 ]
@@ -1076,6 +1137,12 @@ dependencies = [
  "xcb",
 ]
 
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "downcast-rs"
 version = "1.2.0"
@@ -1108,6 +1175,9 @@ name = "either"
 version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "embed-resource"
@@ -1208,6 +1278,17 @@ dependencies = [
  "str-buf",
 ]
 
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "event-listener"
 version = "2.5.3"
@@ -1285,6 +1366,12 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "finl_unicode"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fcfdc7a0362c9f4444381a9e697c79d435fe65b52a37466fc2c1184cee9edc6"
+
 [[package]]
 name = "fixedbitset"
 version = "0.4.2"
@@ -1311,7 +1398,7 @@ dependencies = [
  "futures-sink",
  "nanorand",
  "pin-project",
- "spin",
+ "spin 0.9.8",
 ]
 
 [[package]]
@@ -1407,6 +1494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
@@ -1426,6 +1514,17 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.28"
@@ -1854,6 +1953,19 @@ name = "hashbrown"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.0",
+]
 
 [[package]]
 name = "heck"
@@ -1869,6 +1981,9 @@ name = "heck"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+dependencies = [
+ "unicode-segmentation",
+]
 
 [[package]]
 name = "hermit-abi"
@@ -1882,6 +1997,15 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+dependencies = [
+ "hmac",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -1891,6 +2015,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "home"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.25.2"
@@ -2181,6 +2314,15 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "0.4.8"
@@ -2312,6 +2454,9 @@ name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin 0.5.2",
+]
 
 [[package]]
 name = "lebe"
@@ -2388,6 +2533,23 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "libm"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7012b1bbb0719e1097c47611d3898568c546d597c2e74d66f6087edd5233ff4"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afc22eff61b133b115c6e8c74e818c628d6d5e7a502afea6f64dee076dd94326"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "line-wrap"
 version = "0.1.1"
@@ -2408,7 +2570,7 @@ dependencies = [
  "compact_str",
  "fraction",
  "include_dir",
- "itertools",
+ "itertools 0.10.5",
  "lingua-arabic-language-model",
  "lingua-chinese-language-model",
  "lingua-english-language-model",
@@ -2993,6 +3155,23 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.4"
@@ -3042,6 +3221,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
 dependencies = [
  "autocfg",
+ "libm",
 ]
 
 [[package]]
@@ -3300,6 +3480,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
 [[package]]
 name = "pathdiff"
 version = "0.2.1"
@@ -3318,6 +3504,15 @@ dependencies = [
  "sha2",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.0"
@@ -3464,6 +3659,27 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@@ -3538,6 +3754,7 @@ dependencies = [
  "tauri-plugin-fs-watch",
  "tauri-plugin-log",
  "tauri-plugin-single-instance",
+ "tauri-plugin-sql",
  "tauri-plugin-store",
  "thiserror",
  "tiny_http",
@@ -3918,6 +4135,43 @@ dependencies = [
  "windows 0.37.0",
 ]
 
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab43bb47d23c1a631b4b680199a45255dce26fa9ab2fa902581f624ff13e6a8"
+dependencies = [
+ "byteorder",
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.23"
@@ -3960,6 +4214,36 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
+dependencies = [
+ "ring",
+ "rustls-webpki",
+ "sct",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
+dependencies = [
+ "base64 0.21.3",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d93931baf2d282fff8d3a532bbfd7653f734643161b87e3e01e59a04439bf0d"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@@ -4026,6 +4310,16 @@ dependencies = [
  "xcb",
 ]
 
+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.9.2"
@@ -4298,6 +4592,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e1788eed21689f9cf370582dfc467ef36ed9c707f073528ddafa8d83e3b8500"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.7"
@@ -4373,6 +4677,12 @@ dependencies = [
  "system-deps 5.0.0",
 ]
 
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -4382,6 +4692,229 @@ dependencies = [
  "lock_api",
 ]
 
+[[package]]
+name = "spki"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlformat"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7b278788e7be4d0d29c0f39497a0eef3fba6bbc8e70d8bf7fde46edeaa9e85"
+dependencies = [
+ "itertools 0.11.0",
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e58421b6bc416714d5115a2ca953718f6c621a51b68e4f4922aea5a4391a721"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd4cef4251aabbae751a3710927945901ee1d97ee96d757f6880ebb9a79bfd53"
+dependencies = [
+ "ahash",
+ "atoi",
+ "byteorder",
+ "bytes",
+ "crc",
+ "crossbeam-queue",
+ "dotenvy",
+ "either",
+ "event-listener",
+ "futures-channel",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashlink",
+ "hex",
+ "indexmap 2.0.0",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlformat",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "webpki-roots",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "208e3165167afd7f3881b16c1ef3f2af69fa75980897aac8874a0696516d12c2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a4a8336d278c62231d87f24e8a7a74898156e34c1c18942857be2acb29c7dfc"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.4.1",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 1.0.109",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca69bf415b93b60b80dc8fda3cb4ef52b2336614d8da2de5456cc942a110482"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0db2df1b8731c3651e204629dd55e52adbae0462fa1bdcbed56a2302c18181e"
+dependencies = [
+ "atoi",
+ "base64 0.21.3",
+ "bitflags 2.4.0",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa 1.0.9",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror",
+ "time 0.3.28",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4c21bf34c7cae5b283efb3ac1bcc7670df7561124dc2f8bdc0b59be40f79a2"
+dependencies = [
+ "atoi",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "sqlx-core",
+ "time 0.3.28",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -4435,6 +4968,17 @@ dependencies = [
  "quote",
 ]
 
+[[package]]
+name = "stringprep"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb41d74e231a107a1b4ee36bd1214b11285b77768d2e3824aedafa988fd36ee6"
+dependencies = [
+ "finl_unicode",
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "strsim"
 version = "0.10.0"
@@ -4776,6 +5320,22 @@ dependencies = [
  "zbus",
 ]
 
+[[package]]
+name = "tauri-plugin-sql"
+version = "0.0.0"
+source = "git+https://github.com/tauri-apps/plugins-workspace?branch=v1#5b814f56e6368fdec46c4ddb04a07e0923ff995a"
+dependencies = [
+ "futures-core",
+ "log",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "tauri",
+ "thiserror",
+ "time 0.3.28",
+ "tokio",
+]
+
 [[package]]
 name = "tauri-plugin-store"
 version = "0.0.0"
@@ -5052,6 +5612,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-stream"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.8"
@@ -5122,6 +5693,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
 dependencies = [
  "cfg-if",
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -5258,6 +5830,18 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
 
+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
 [[package]]
 name = "url"
 version = "2.4.1"
@@ -5585,6 +6169,15 @@ dependencies = [
  "system-deps 6.1.1",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
+dependencies = [
+ "rustls-webpki",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.19.1"
@@ -5629,6 +6222,12 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
 
+[[package]]
+name = "whoami"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22fc3756b8a9133049b26c7f61ab35416c130e8c09b660f5b3958b446f52cc50"
+
 [[package]]
 name = "widestring"
 version = "1.0.2"
@@ -6250,6 +6849,12 @@ dependencies = [
  "zvariant",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a0956f1ba7c7909bfb66c2e9e4124ab6f6482560f6628b5aaeba39207c9aad9"
+
 [[package]]
 name = "zip"
 version = "0.6.6"
diff --git a/pkgs/applications/misc/pot/default.nix b/pkgs/applications/misc/pot/default.nix
index 1b644f765d39..a2b1971b369e 100644
--- a/pkgs/applications/misc/pot/default.nix
+++ b/pkgs/applications/misc/pot/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pot";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "pot-app";
     repo = "pot-desktop";
     rev = version;
-    hash = "sha256-8AIOAM3xEmKn++DqgXVDhCGlPMoeQPGrKtuUnPXmoeU=";
+    hash = "sha256-PvbqPGT8BTHEufYp+TUSd0tTSBnTBDIYHxaeI7FEVDE=";
   };
 
   sourceRoot = "${src.name}/src-tauri";
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-+/GDP3IFCidIs2/ZqQX7pZmZNQrCHNT6uy+x1CKkCmI=";
+    outputHash = "sha256-iHFzv8dMC0TT6PtMJmL0EufZ8TnbyjmsoBH3Z8U48D0=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
diff --git a/pkgs/applications/misc/waypaper/default.nix b/pkgs/applications/misc/waypaper/default.nix
index 86c23400f1ba..cfb7ec3abf69 100644
--- a/pkgs/applications/misc/waypaper/default.nix
+++ b/pkgs/applications/misc/waypaper/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "waypaper";
-  version = "1.5";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "anufrievroman";
     repo = "waypaper";
     rev = "refs/tags/${version}";
-    hash = "sha256-lK4TygR9cwEHcnrC0E5vE7Jor6afEiM9TmEgGXj+hNA=";
+    hash = "sha256-6hv+f2fbrbLodJIRHl5MYTkiZ51iZOAK42Vg73zSw/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 6c1918aa7bd8..b754edb111cc 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.8.0";
+  version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-/BMagPR74pANVYcmvdJZmV4tB48cEyAy0FKtBlpoLDE=";
+    hash = "sha256-sVaUItort09n2aShrE0MqOKQps44qNQv0Nox4P21xqg=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-xiCgQqP2XF+b2JQTBFqJ3h2klc6GjqyXoNUwatO0Ul8=";
+  vendorHash = "sha256-WeDIvw9KHDL5h/MQ9H1rOZkAlUOzROGw/gwpZB2jvOg=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
diff --git a/pkgs/applications/networking/cluster/helm-docs/default.nix b/pkgs/applications/networking/cluster/helm-docs/default.nix
index 3a09148394f7..657d428912dd 100644
--- a/pkgs/applications/networking/cluster/helm-docs/default.nix
+++ b/pkgs/applications/networking/cluster/helm-docs/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-docs";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "norwoodj";
     repo = "helm-docs";
     rev = "v${version}";
-    sha256 = "sha256-476ZhjRwHlNJFkHzY8qQ7WbAUUpFNSoxXLGX9esDA/E=";
+    hash = "sha256-4o3hdqaW/AtegKStMKVerE3dRr3iZxQ+Lm2Aj3aOy98=";
   };
 
-  vendorSha256 = "sha256-xXwunk9rmzZEtqmSo8biuXnAjPp7fqWdQ+Kt9+Di9N8=";
+  vendorHash = "sha256-6byD8FdeqdRDNUZFZ7FUUdyTuFOO8s3rb6YPGKdwLB8=";
 
   subPackages = [ "cmd/helm-docs" ];
   ldflags = [
diff --git a/pkgs/applications/networking/cluster/karmor/default.nix b/pkgs/applications/networking/cluster/karmor/default.nix
index f663c562f4d8..b3b480015156 100644
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "0.13.15";
+  version = "0.13.16";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-irpfZFswZjowKDnHmoutTo6960jl5C3Dq+NurjOk3p8=";
+    hash = "sha256-MEP7OlmsPe5qpdFBEOzCsJqLdZ5t7bMwPE/JhP9bGTY=";
   };
 
-  vendorHash = "sha256-raMR27DqgT/Hjp3yAMAKLbfOjIZs0K0XsncgmIP6vxk=";
+  vendorHash = "sha256-5r5UqWRmqrLcpTeYpezGxIMj9JnPaohhd1i7VvaBVGM=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -51,6 +51,6 @@ buildGoModule rec {
     homepage = "https://kubearmor.io";
     changelog = "https://github.com/kubearmor/kubearmor-client/releases/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom kashw2 ];
   };
 }
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index c25092c9962d..4b9b37925910 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -24,9 +24,10 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
-    homepage = "https://stackexchange.github.io/dnscontrol/";
+    homepage = "https://dnscontrol.org/";
     changelog = "https://github.com/StackExchange/dnscontrol/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ mmahut SuperSandro2000 ];
+    mainProgram = "dnscontrol";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/nheko/default.nix b/pkgs/applications/networking/instant-messengers/nheko/default.nix
index 5dc6bde6fed6..acc6f8948fc0 100644
--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , asciidoc
 , pkg-config
@@ -42,6 +43,22 @@ stdenv.mkDerivation rec {
     hash = "sha256-2daXxTbpSUlig47y901JOkWRxbZGH4qrvNMepJbvS3o=";
   };
 
+  patches = [
+    # The 2 following patches can be removed with the next version bump.
+    # Backport of https://github.com/Nheko-Reborn/nheko/commit/e89e65dc17020772eb057414b4f0c5d6f4ad98d0.
+    (fetchpatch {
+      name = "nheko-fmt10.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/nheko/-/raw/1b0d5c9eff6409dfd82953f346546d36c288a4a9/nheko-0.11.3-fix-for-fmt-10.patch";
+      hash = "sha256-UYqAu2iXT3Bn/MxCtybiJrJLfVMOOVRchWqrGuPfapI=";
+    })
+    # https://github.com/Nheko-Reborn/nheko/pull/1552
+    (fetchpatch {
+      name = "nheko-fmt10.1.patch";
+      url = "https://github.com/Nheko-Reborn/nheko/commit/614facf93c2b5d6118beb822cc542ac53a883c37.patch";
+      hash = "sha256-rjsQNDfj3Lzbv8ow3qiNozGXQFrtYLhArS6a9JCdgBQ=";
+    })
+  ];
+
   nativeBuildInputs = [
     asciidoc
     cmake
diff --git a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
index a606b3f130ef..32e47a3616c6 100644
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.12.0";
+  version = "0.12.1";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}-Linux.tar.gz";
-    hash = "sha256-PMLc0o+zwtdtY2p5z5xwdcawNKddenr64vmC+dxrw+Y=";
+    hash = "sha256-pxDSAVh/zg3hCuTlSuilgD4VKe1CPSG/ZLl0TF1nc1I=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/AsamK/signal-cli";
     description = "Command-line and dbus interface for communicating with the Signal messaging service";
+    changelog = "https://github.com/AsamK/signal-cli/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3;
     maintainers = with maintainers; [ ivan ];
     platforms = platforms.all;
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index ec318aa3e18e..5fa07ea7a923 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -8,22 +8,24 @@
 , nodejs
 , fetchYarnDeps
 , fixup_yarn_lock
-, electron
+, electron_24
 , libpulseaudio
 , pipewire
 , alsa-utils
 , which
+, testers
+, teams-for-linux
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.3.2";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2WoTbkRGH9l6cQrveyxGvO/Dy+0NV4UTDaooYn8k06s=";
+    hash = "sha256-G0UBzSXoZPLHBsM0nslPLNBZs0sUAQYJ403nPV+3Qu4=";
   };
 
   offlineCache = fetchYarnDeps {
@@ -50,8 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     yarn --offline electron-builder \
       --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
-      -c.electronDist=${electron}/lib/electron \
-      -c.electronVersion=${electron.version}
+      -c.electronDist=${electron_24}/libexec/electron \
+      -c.electronVersion=${electron_24.version}
 
     runHook postBuild
   '';
@@ -70,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     popd
 
     # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
-    makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
+    makeWrapper '${electron_24}/bin/electron' "$out/bin/teams-for-linux" \
       ${lib.optionalString stdenv.isLinux ''
         --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
@@ -91,12 +93,16 @@ stdenv.mkDerivation (finalAttrs: {
   })];
 
   passthru.updateScript = ./update.sh;
+  passthru.tests.version = testers.testVersion rec {
+    package = teams-for-linux;
+    command = "HOME=$TMPDIR ${package.meta.mainProgram or package.pname} --version";
+  };
 
   meta = {
     description = "Unofficial Microsoft Teams client for Linux";
     homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ muscaln lilyinstarlight ];
+    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly ];
     platforms = lib.platforms.unix;
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index 81e6986fc5d6..6674e957cb5b 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -23,12 +23,12 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.2.11";
+  version = "2.2.12";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-EjJc9m1f+KxL2H+sjbUshp3lLdJ4/DAc/VfVofn0Zcw=";
+    hash = "sha256-BDrzEvZLjlb3/Qv3f4SiBdTEmAML2VhkV2ZcR7sYzjg=";
   };
 
   patches = [
@@ -103,6 +103,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A small but very powerful text-based mail client";
     homepage = "http://www.mutt.org";
+    mainProgram = "mutt";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ rnhmjoj ];
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index adce1d4801f8..0699a9ffb236 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -25,7 +25,7 @@
 
 mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.9.3";
+  version = "3.9.4";
 
   outputs = [ "out" "dev" ];
 
@@ -33,7 +33,7 @@ mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    sha256 = "sha256-9DfQZ3AFyiUKwt8IqAgjQlQ2XJtwkLEtPM5+VH+x/6c=";
+    sha256 = "sha256-h8lOstl085haesmCmzq2o0OlQrO5U/mfGngQunynIuQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/p2p/lokinet/default.nix b/pkgs/applications/networking/p2p/lokinet/default.nix
index 574380ed697d..f77323d2bcf6 100644
--- a/pkgs/applications/networking/p2p/lokinet/default.nix
+++ b/pkgs/applications/networking/p2p/lokinet/default.nix
@@ -8,13 +8,20 @@
 , nlohmann_json
 , pkg-config
 , spdlog
+, fmt_9
 , sqlite
 , systemd
 , unbound
 , zeromq
 }:
+let
+  # Upstream has received reports of incompatibilities with fmt, and other
+  # dependencies, see: https://github.com/oxen-io/lokinet/issues/2200.
+  spdlog' = spdlog.override {
+    fmt = fmt_9;
+  };
 
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
   pname = "lokinet";
   version = "0.9.11";
 
@@ -36,7 +43,7 @@ stdenv.mkDerivation rec {
     libuv
     libsodium
     nlohmann_json
-    spdlog
+    spdlog'
     sqlite
     systemd
     unbound
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index ba22a71eebd3..65b9630fd5a0 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,20 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.86.2";
+  version = "1.87.3";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-peWcgME+OCa9feNKLtTmZIGCpNxl+EdQfYDXV2BbclI=";
+    hash = "sha256-16h7PzZVFnaHMyODLk9tSrW8OiXQlcuDobANG1ZQVxs=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-sBez/IQzRIGQdOXr4Ikxh+dT8IQxtbxau5vo9VqGJvE=";
+  vendorHash = "sha256-gskOhLdrRzbvZwuOlm04fjeSXhNr/cqVGejEPZVtuBk=";
+
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Command-line tool for Storj";
diff --git a/pkgs/applications/office/appflowy/default.nix b/pkgs/applications/office/appflowy/default.nix
index 46d514187d52..11d291238727 100644
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "appflowy";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy_x86_64-unknown-linux-gnu_ubuntu-20.04.tar.gz";
-    sha256 = "sha256-05RQtvf6I4/sjGtMDfc5U4esxfFFeTwIuxFAkbr6p4A";
+    hash = "sha256-jIekGA+MG9tvjEyHAI3dcD7lI1JL/qPqRpVO9gRhcTw=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/office/onlyoffice-bin/default.nix b/pkgs/applications/office/onlyoffice-bin/7_2.nix
similarity index 94%
rename from pkgs/applications/office/onlyoffice-bin/default.nix
rename to pkgs/applications/office/onlyoffice-bin/7_2.nix
index ba4a75ddfbaa..8abf0909e6b3 100644
--- a/pkgs/applications/office/onlyoffice-bin/default.nix
+++ b/pkgs/applications/office/onlyoffice-bin/7_2.nix
@@ -177,6 +177,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    longDescription = ''
+      The latest versions of OnlyOffice are currently broken on wlroots environments (e.g. Hyprland, Sway).
+      If you are using a different environment, you can get the latest version using `onlyoffice-bin_latest`.
+    '';
     homepage = "https://www.onlyoffice.com/";
     downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
     changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
diff --git a/pkgs/applications/office/onlyoffice-bin/7_4.nix b/pkgs/applications/office/onlyoffice-bin/7_4.nix
new file mode 100644
index 000000000000..bf587a4c9bc2
--- /dev/null
+++ b/pkgs/applications/office/onlyoffice-bin/7_4.nix
@@ -0,0 +1,215 @@
+{ stdenv
+, lib
+, fetchurl
+, buildFHSEnv
+  # Alphabetic ordering below
+, alsa-lib
+, at-spi2-atk
+, atk
+, autoPatchelfHook
+, cairo
+, curl
+, dbus
+, dconf
+, dpkg
+, fontconfig
+, gcc-unwrapped
+, gdk-pixbuf
+, glib
+, glibc
+, gsettings-desktop-schemas
+, gst_all_1
+, gtk2
+, gtk3
+, libpulseaudio
+, libudev0-shim
+, libdrm
+, makeWrapper
+, mesa
+, nspr
+, nss
+, pulseaudio
+, qt5
+, wrapGAppsHook
+, xkeyboard_config
+, xorg
+}:
+let
+
+  # Note on fonts:
+  #
+  # OnlyOffice does not distribute unfree fonts, but makes it easy to pick up
+  # any fonts you install. See:
+  #
+  # * https://helpcenter.onlyoffice.com/en/installation/docs-community-install-fonts-linux.aspx
+  # * https://www.onlyoffice.com/blog/2020/04/how-to-add-new-fonts-to-onlyoffice-desktop-editors/
+  #
+  # As recommended there, you should download
+  #
+  #     arial.ttf, calibri.ttf, cour.ttf, symbol.ttf, times.ttf, wingding.ttf
+  #
+  # into `~/.local/share/fonts/`, otherwise the default template fonts, and
+  # things like bullet points, will not look as expected.
+
+  # TODO: Find out which of these fonts we'd be allowed to distribute along
+  #       with this package, or how to make this easier for users otherwise.
+
+  # Not using the `noto-fonts-cjk` package from nixpkgs, because it was
+  # reported that its `.ttc` file is not picked up by OnlyOffice, see:
+  # https://github.com/NixOS/nixpkgs/pull/116343#discussion_r593979816
+  noto-fonts-cjk = fetchurl {
+    url =
+      let
+        version = "v20201206-cjk";
+      in
+      "https://github.com/googlefonts/noto-cjk/raw/${version}/NotoSansCJKsc-Regular.otf";
+    sha256 = "sha256-aJXSVNJ+p6wMAislXUn4JQilLhimNSedbc9nAuPVxo4=";
+  };
+
+  runtimeLibs = lib.makeLibraryPath [
+    curl
+    glibc
+    gcc-unwrapped.lib
+    libudev0-shim
+    pulseaudio
+  ];
+
+  derivation = stdenv.mkDerivation rec {
+    pname = "onlyoffice-desktopeditors";
+    version = "7.4.1";
+    minor = null;
+    src = fetchurl {
+      url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
+      sha256 = "sha256-vaBF3GJyLBldWdEruOeVpRvwGNwaRl7IKPguDLRoe8M=";
+    };
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-atk
+      atk
+      cairo
+      dbus
+      dconf
+      fontconfig
+      gdk-pixbuf
+      glib
+      gsettings-desktop-schemas
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+      gtk2
+      gtk3
+      libpulseaudio
+      libdrm
+      nspr
+      nss
+      mesa # libgbm
+      qt5.qtbase
+      qt5.qtdeclarative
+      qt5.qtsvg
+      qt5.qtwayland
+      xorg.libX11
+      xorg.libxcb
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXScrnSaver
+      xorg.libXtst
+    ];
+
+    dontWrapQtApps = true;
+
+    unpackPhase = ''
+      dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
+    '';
+
+    preConfigure = ''
+      cp --no-preserve=mode,ownership ${noto-fonts-cjk} opt/onlyoffice/desktopeditors/fonts/
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib,share}
+
+      mv usr/bin/* $out/bin
+      mv usr/share/* $out/share/
+      mv opt/onlyoffice/desktopeditors $out/share
+
+      for f in $out/share/desktopeditors/asc-de-*.png; do
+        size=$(basename "$f" ".png" | cut -d"-" -f3)
+        res="''${size}x''${size}"
+        mkdir -pv "$out/share/icons/hicolor/$res/apps"
+        ln -s "$f" "$out/share/icons/hicolor/$res/apps/onlyoffice-desktopeditors.png"
+      done;
+
+      substituteInPlace $out/bin/onlyoffice-desktopeditors \
+        --replace "/opt/onlyoffice/" "$out/share/"
+
+      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale" \
+        --set QT_QPA_PLATFORM "xcb"
+        # the bundled version of qt does not support wayland
+      )
+    '';
+
+    passthru.updateScript = ./update.sh;
+  };
+
+in
+
+# In order to download plugins, OnlyOffice uses /usr/bin/curl so we have to wrap it.
+# Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+buildFHSEnv {
+  name = derivation.name;
+
+  targetPkgs = pkgs': [
+    curl
+    derivation
+  ];
+
+  runScript = "/bin/onlyoffice-desktopeditors";
+
+  extraInstallCommands = ''
+    mv $out/bin/$name $out/bin/onlyoffice-desktopeditors
+    mkdir -p $out/share
+    ln -s ${derivation}/share/icons $out/share
+    cp -r ${derivation}/share/applications $out/share
+    substituteInPlace $out/share/applications/onlyoffice-desktopeditors.desktop \
+        --replace "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
+  '';
+
+  meta = with lib; {
+    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    longDescription = ''
+      This version is broken on wlroots environments (e.g. Hyprland, Sway).
+      If you are using one of these environments, please use `onlyoffice-bin` instead.
+    '';
+    homepage = "https://www.onlyoffice.com/";
+    downloadPage = "https://github.com/ONLYOFFICE/DesktopEditors/releases";
+    changelog = "https://github.com/ONLYOFFICE/DesktopEditors/blob/master/CHANGELOG.md";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ nh2 gtrunsec ];
+  };
+}
diff --git a/pkgs/applications/radio/gnuradio/default.nix b/pkgs/applications/radio/gnuradio/default.nix
index 49d3c4234cd4..a443aec53678 100644
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 # Remove gcc and python references
 , removeReferencesTo
@@ -299,6 +300,12 @@ stdenv.mkDerivation {
   patches = [
     # Not accepted upstream, see https://github.com/gnuradio/gnuradio/pull/5227
     ./modtool-newmod-permissions.patch
+    # https://github.com/gnuradio/gnuradio/pull/6808
+    (fetchpatch {
+      name = "gnuradio-fmt10.1.patch";
+      url = "https://github.com/gnuradio/gnuradio/commit/9357c17721a27cc0aae3fe809af140c84e492f37.patch";
+      hash = "sha256-w3b22PTqoORyYQ3RKRG+2htQWbITzQiOdSDyuejUtHQ=";
+    })
   ];
   passthru = shared.passthru // {
     # Deps that are potentially overridden and are used inside GR plugins - the same version must
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 6fd4774df75b..5cd8819445b3 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -41,22 +41,24 @@
 , qtwebengine
 , rtl-sdr
 , serialdv
+, sdrplay
 , sgp4
 , soapysdr-with-plugins
 , uhd
 , wrapQtAppsHook
 , zlib
+, withSDRplay ? false
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdrangel";
-  version = "7.15.2";
+  version = "7.15.4";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Yvf0LJu7YbXhW3i0fd5R2KVn2dkx484AZ0XaWhjozFE=";
+    hash = "sha256-oSFnoNmoXvdb5lpx/j3DVVhOfbsDZlGNZNcvud1w8Ks=";
   };
 
   nativeBuildInputs = [
@@ -108,7 +110,8 @@ stdenv.mkDerivation (finalAttrs: {
     soapysdr-with-plugins
     uhd
     zlib
-  ];
+  ]
+  ++ lib.optionals withSDRplay [ sdrplay ];
 
   cmakeFlags = [
     "-DAPT_DIR=${aptdec}"
diff --git a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
index 2b74a7de24e5..51e1011b8a2f 100644
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@@ -67,6 +67,12 @@ in stdenv.mkDerivation rec {
       url = "https://github.com/emsec/hal/commit/37d5c1a0eacb25de57cc552c13e74f559a5aa6e8.patch";
       hash = "sha256-a30VjDt4roJOTntisixqnH17wwCgWc4VWeh1+RgqFuY=";
     })
+    (fetchpatch {
+      name = "hal-fix-fmt-10.1-compat.patch";
+      # https://github.com/emsec/hal/pull/530
+      url = "https://github.com/emsec/hal/commit/b639a56b303141afbf6731b70b7cc7452551f024.patch";
+      hash = "sha256-a7AyDEKkqdbiHpa4OHTRuP9Yewb3Nxs/j6bwez5m0yU=";
+    })
   ];
 
   # make sure bundled dependencies don't get in the way - install also otherwise
@@ -126,6 +132,7 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
     homepage = "https://github.com/emsec/hal";
     license = licenses.mit;
diff --git a/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch b/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
new file mode 100644
index 000000000000..e370bc860b55
--- /dev/null
+++ b/pkgs/applications/science/electronics/openroad/0001-Disable-failing-regression-tests.patch
@@ -0,0 +1,83 @@
+From dc32aabd50d53aece41d968649b972ee667875bb Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 27 Aug 2023 15:08:50 +0200
+Subject: [PATCH] Disable failing regression tests
+
+---
+ src/drt/test/regression_tests.tcl | 6 +++---
+ src/odb/test/regression_tests.tcl | 4 ++--
+ src/par/test/regression_tests.tcl | 2 +-
+ src/pdn/test/regression_tests.tcl | 2 +-
+ src/rcx/test/regression_tests.tcl | 6 +++---
+ 5 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/src/drt/test/regression_tests.tcl b/src/drt/test/regression_tests.tcl
+index 11705562d..15546244a 100644
+--- a/src/drt/test/regression_tests.tcl
++++ b/src/drt/test/regression_tests.tcl
+@@ -9,6 +9,6 @@ record_tests {
+   top_level_term
+   top_level_term2
+ }
+-record_pass_fail_tests {
+-  gc_test
+-}
++#record_pass_fail_tests {
++#  gc_test
++#}
+diff --git a/src/odb/test/regression_tests.tcl b/src/odb/test/regression_tests.tcl
+index b8e4f917a..7c6a0223a 100644
+--- a/src/odb/test/regression_tests.tcl
++++ b/src/odb/test/regression_tests.tcl
+@@ -34,9 +34,9 @@ record_tests {
+ }
+ 
+ record_pass_fail_tests {
+-  cpp_tests
++  #cpp_tests
+   dump_netlists
+   dump_netlists_withfill
+-  parser_unit_test
++  #parser_unit_test
+ }
+ 
+diff --git a/src/par/test/regression_tests.tcl b/src/par/test/regression_tests.tcl
+index 9ff31fb12..63d5d0dae 100644
+--- a/src/par/test/regression_tests.tcl
++++ b/src/par/test/regression_tests.tcl
+@@ -1,4 +1,4 @@
+ record_tests {
+   read_part
+-  partition_gcd
++  #partition_gcd
+ }
+diff --git a/src/pdn/test/regression_tests.tcl b/src/pdn/test/regression_tests.tcl
+index 86c334f24..b695c490c 100644
+--- a/src/pdn/test/regression_tests.tcl
++++ b/src/pdn/test/regression_tests.tcl
+@@ -10,7 +10,7 @@ record_tests {
+   max_width
+   min_spacing
+   widthtable
+-  design_width
++  #design_width
+   offgrid
+ 
+   core_grid
+diff --git a/src/rcx/test/regression_tests.tcl b/src/rcx/test/regression_tests.tcl
+index 7070cc45f..72f348d96 100644
+--- a/src/rcx/test/regression_tests.tcl
++++ b/src/rcx/test/regression_tests.tcl
+@@ -6,6 +6,6 @@ record_tests {
+   45_gcd
+   names
+ }
+-record_pass_fail_tests {
+-  rcx_unit_test
+-}
++#record_pass_fail_tests {
++#  rcx_unit_test
++#}
+-- 
+2.41.0
+
diff --git a/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch b/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
deleted file mode 100644
index 0332ade17dc7..000000000000
--- a/pkgs/applications/science/electronics/openroad/0001-Fix-string-formatting-in-tests.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Benes <nbenes.gh@xandea.de>
-Date: Sun, 2 Apr 2023 01:24:51 +0200
-Subject: [PATCH] Fix string formatting in tests
-
-Hide the decimal point and digits after the decimal point when they are
-not needed.
-
-diff --git a/src/par/test/partition_gcd.ok b/src/par/test/partition_gcd.ok
-index 6c40c14..b9a42f6 100644
---- a/src/par/test/partition_gcd.ok
-+++ b/src/par/test/partition_gcd.ok
-@@ -9,7 +9,7 @@
- ========================================
- [INFO] Partitioning parameters**** 
- [PARAM] Number of partitions = 2
--[PARAM] UBfactor = 1.0
-+[PARAM] UBfactor = 1
- [PARAM] Vertex dimensions = 1
- [PARAM] Hyperedge dimensions = 1
- ========================================
-@@ -118,7 +118,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
--[INFO] V-cycle refinement 1 delta cost 0.0
-+[INFO] V-cycle refinement 1 delta cost 0
- =========================================
- [STATUS] Running FC multilevel coarsening 
- =========================================
-@@ -133,7 +133,7 @@ After Hyperedge Reduction :  num_vertices = 137, num_hyperedges = 251
- [V-Refine] Level 2 :: 207, 301, 154.65254
- [V-Refine] Level 3 :: 312, 370, 154.65254
- [V-Refine] Level 4 :: 469, 451, 154.65254
--[INFO] V-cycle refinement 2 delta cost 0.0
-+[INFO] V-cycle refinement 2 delta cost 0
- [Cutcost of partition : 154.65254]
- [Vertex balance of block_0 : 0.59249  ( 327.17993 )    
- [Vertex balance of block_1 : 0.40751  ( 225.03609 )    
-diff --git a/src/pdn/test/design_width.ok b/src/pdn/test/design_width.ok
-index 381dca1..a102974 100644
---- a/src/pdn/test/design_width.ok
-+++ b/src/pdn/test/design_width.ok
-@@ -9,5 +9,5 @@
- [INFO ODB-0130]     Created 54 pins.
- [INFO ODB-0131]     Created 406 components and 1816 component-terminals.
- [INFO ODB-0133]     Created 361 nets and 1004 connections.
--[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6.0 um and offset 10.0 um.
-+[ERROR PDN-0185] Insufficient width (14.04 um) to add straps on layer M8 in grid "Core" with total strap width 6 um and offset 10 um.
- PDN-0185
--- 
-2.38.4
-
diff --git a/pkgs/applications/science/electronics/openroad/default.nix b/pkgs/applications/science/electronics/openroad/default.nix
index 36f168a02b63..16659892a6ee 100644
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , bison
 , cmake
 , doxygen
@@ -34,14 +35,14 @@
 
 mkDerivation rec {
   pname = "openroad";
-  version = "unstable-2023-03-31";
+  version = "unstable-2023-08-26";
 
   src = fetchFromGitHub {
     owner = "The-OpenROAD-Project";
     repo = "OpenROAD";
-    rev = "cd03c5cf8a8eb78c0e07fe33a56b8e9d64672efe";
+    rev = "6dba515c2aacd3fca58ef8135424884146efd95b";
     fetchSubmodules = true;
-    hash = "sha256-BWUvFCuWKWQpifErpak03J+A7ni0jZWIrCMhMdKIbD0=";
+    hash = "sha256-LAj7X+Vq0+H3tIo5zgyUuIjQwTj+2DLL18/KMJ/kf4A=";
   };
 
   nativeBuildInputs = [
@@ -79,7 +80,16 @@ mkDerivation rec {
   ];
 
   patches = [
-    ./0001-Fix-string-formatting-in-tests.patch
+    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/3911
+    (fetchpatch {
+      name = "openroad-fix-fmt-10.patch";
+      url = "https://github.com/The-OpenROAD-Project/OpenROAD/commit/9396f07f28e0260cd64acfc51909f6566b70e682.patch";
+      hash = "sha256-jy8K8pdhSswVz6V6otk8JAI7nndaFVMuKQ/4A3Kzwns=";
+    })
+    # Upstream is not aware of these failures
+    ./0001-Disable-failing-regression-tests.patch
+    # This is an issue we experience in the sandbox, and upstream
+    # probably wouldn't mind merging this change, but no PR was opened.
     ./0002-Ignore-warning-on-stderr.patch
   ];
 
@@ -89,20 +99,17 @@ mkDerivation rec {
 
   # Enable output images from the placer.
   cmakeFlags = [
+    # Tries to download gtest 1.13 as part of the build. We currently rely on
+    # the regression tests so we can get by without building unit tests.
+    "-DENABLE_TESTS=OFF"
     "-DUSE_SYSTEM_BOOST=ON"
     "-DUSE_CIMG_LIB=ON"
     "-DOPENROAD_VERSION=${src.rev}"
-
-    # 2023-03-31: see discussion on fmt workaround in
-    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/2696
-    "-DCMAKE_CXX_FLAGS=-DFMT_DEPRECATED_OSTREAM"
   ];
 
   # Resynthesis needs access to the Yosys binaries.
   qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];
 
-  checkInputs = [ gtest ];
-
   # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
   # to see if there are any breaking changes in unstable that should be vendored as well.
   doCheck = true;
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 61c608da48c3..e1d1c6638c0a 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.20.3-0";
+  version = "1.20.4-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-pMmP9JJHbaqkHHgtZf2ZgEtXsX97EV0VXiTPT7Lf4P8=";
+    hash = "sha256-guKU3VG1Wyhr5p6w0asL/CopQ5b7HiNi26Tw8WCEpwE=";
   };
 
   vendorHash = "sha256-dgtZjsLBwblhdge3BvdbK/mN/TeZKps9K5dJbqomtjo=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
index c1e2935765ef..6bf44a1deae2 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-container-registry/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "3.82.0";
+  version = "3.83.0";
   rev = "v${version}-gitlab";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    sha256 = "sha256-umlpGpeN7sWe8524+wjdYYJegLdc+eQqlgySLWL0a+k=";
+    sha256 = "sha256-HYyPe4x8hwtKAr0r4dGUbIyiLRQKtlWQ4Pt2mtbQmZM=";
   };
 
-  vendorHash = "sha256-hFGuzTM9+Zb8BmUoFG059eqM53AzOmi1DeBnF68WSoc=";
+  vendorHash = "sha256-OX8drOl8D30gYFnLzZe9i1whguXe0QFhsLpP9G9seuk=";
 
   patches = [
     ./Disable-inmemory-storage-driver-test.patch
diff --git a/pkgs/applications/virtualization/podman-desktop/default.nix b/pkgs/applications/virtualization/podman-desktop/default.nix
index 30dd54ba85ce..412db059eac7 100644
--- a/pkgs/applications/virtualization/podman-desktop/default.nix
+++ b/pkgs/applications/virtualization/podman-desktop/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     yarn --offline run build
     yarn --offline run electron-builder --dir \
       --config .electron-builder.config.cjs \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/applications/window-managers/windowmaker/default.nix b/pkgs/applications/window-managers/windowmaker/default.nix
deleted file mode 100644
index 8c354c616fd2..000000000000
--- a/pkgs/applications/window-managers/windowmaker/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libX11, libXext, libXft, libXmu, libXinerama, libXrandr, libXpm
-, imagemagick, libpng, libjpeg, libexif, libtiff, giflib, libwebp }:
-
-stdenv.mkDerivation rec {
-  pname = "windowmaker";
-  version = "0.95.9";
-  srcName = "WindowMaker-${version}";
-
-  src = fetchurl {
-    url = "http://windowmaker.org/pub/source/release/${srcName}.tar.gz";
-    sha256 = "055pqvlkhipyjn7m6bb3fs4zz9rd1ynzl0mmwbhp05ihc3zmh8zj";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ libX11 libXext libXft libXmu libXinerama libXrandr libXpm
-                  imagemagick libpng libjpeg libexif libtiff giflib libwebp ];
-
-  configureFlags = [
-    "--with-x"
-    "--enable-modelock"
-    "--enable-randr"
-    "--enable-webp"
-    "--disable-magick" # Many distros reported imagemagick fails to be found
-  ];
-
-  meta = with lib; {
-    homepage = "http://windowmaker.org/";
-    description = "NeXTSTEP-like window manager";
-    longDescription = ''
-      Window Maker is an X11 window manager originally designed to
-      provide integration support for the GNUstep Desktop
-      Environment. In every way possible, it reproduces the elegant look
-      and feel of the NEXTSTEP user interface. It is fast, feature rich,
-      easy to configure, and easy to use. It is also free software, with
-      contributions being made by programmers from around the world.
-    '';
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.AndersonTorres ];
-  };
-}
diff --git a/pkgs/by-name/ai/airscan/package.nix b/pkgs/by-name/ai/airscan/package.nix
new file mode 100644
index 000000000000..0859a6c21be8
--- /dev/null
+++ b/pkgs/by-name/ai/airscan/package.nix
@@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "airscan";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stapelberg";
+    repo = "airscan";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gk0soDzrsFBh+SrWcfO/quW6JweX6MthOigTHcaq1oE=";
+  };
+
+  vendorHash = "sha256-I5JRGaff6OIwx4q7BjpFwvJiQe4kw03V8+McYPcJhho=";
+
+  meta = with lib; {
+    description = "Package to scan paper documents using the Apple AirScan (eSCL) protocol";
+    homepage = "https://github.com/stapelberg/airscan";
+    changelog = "https://github.com/stapelberg/airscan/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ johannwagner ];
+  };
+}
diff --git a/pkgs/applications/emulators/bochs/default.nix b/pkgs/by-name/bo/bochs/package.nix
similarity index 94%
rename from pkgs/applications/emulators/bochs/default.nix
rename to pkgs/by-name/bo/bochs/package.nix
index edf092028fc0..803d6ae2852e 100644
--- a/pkgs/applications/emulators/bochs/default.nix
+++ b/pkgs/by-name/bo/bochs/package.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , SDL2
 , curl
+, darwin
 , docbook_xml_dtd_45
 , docbook_xsl
 , gtk3
@@ -10,13 +11,12 @@
 , libGLU
 , libX11
 , libXpm
-, libobjc
 , libtool
 , ncurses
 , pkg-config
 , readline
 , wget
-, wxGTK
+, wxGTK32
 , enableSDL2 ? true
 , enableTerm ? true
 , enableWx ? !stdenv.isDarwin
@@ -49,14 +49,14 @@ stdenv.mkDerivation (finalAttrs: {
     ncurses
   ] ++ lib.optionals enableWx [
     gtk3
-    wxGTK
+    wxGTK32
   ] ++ lib.optionals enableX11 [
     libGL
     libGLU
     libX11
     libXpm
   ] ++ lib.optionals stdenv.isDarwin [
-    libobjc
+    darwin.libobjc
   ];
 
   configureFlags = [
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://bochs.sourceforge.io/";
     description = "An open-source IA-32 (x86) PC emulator";
     longDescription = ''
@@ -142,9 +142,9 @@ stdenv.mkDerivation (finalAttrs: {
       in C++, that runs on most popular platforms. It includes emulation of the
       Intel x86 CPU, common I/O devices, and a custom BIOS.
     '';
-    license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.unix;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
   };
 })
 # TODO: a better way to organize the options
diff --git a/pkgs/shells/tcsh/default.nix b/pkgs/by-name/tc/tcsh/package.nix
similarity index 100%
rename from pkgs/shells/tcsh/default.nix
rename to pkgs/by-name/tc/tcsh/package.nix
diff --git a/pkgs/by-name/up/upiano/package.nix b/pkgs/by-name/up/upiano/package.nix
new file mode 100644
index 000000000000..d13ff18bd425
--- /dev/null
+++ b/pkgs/by-name/up/upiano/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "upiano";
+  version = "0.1.2";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "eliasdorneles";
+    repo = "upiano";
+    rev = "v${version}";
+    hash = "sha256-5WhflvUCjzW4ZJ+PLUTMbKcUnQa3ChkDjl0R5YvjBWk=";
+    forceFetchGit = true;
+    fetchLFS = true;
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyfluidsynth
+    textual
+  ];
+
+  pythonImportsCheck = [ "upiano" ];
+
+  meta = with lib; {
+    description = "A Piano in your terminal";
+    homepage = "https://github.com/eliasdorneles/upiano";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "upiano";
+  };
+}
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/AlsaMixer-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/AlsaMixer-app.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/default.nix b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/default.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/default.nix
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/libdockapp.nix b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/libdockapp.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/wmCalClock.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/wmCalClock.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/wmsm-app.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
diff --git a/pkgs/applications/window-managers/windowmaker/dockapps/wmsystemtray.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
similarity index 100%
rename from pkgs/applications/window-managers/windowmaker/dockapps/wmsystemtray.nix
rename to pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
diff --git a/pkgs/by-name/wi/windowmaker/package.nix b/pkgs/by-name/wi/windowmaker/package.nix
new file mode 100644
index 000000000000..2381c16f41ae
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchFromRepoOrCz
+, autoreconfHook
+, pkg-config
+, imagemagick
+, libX11
+, libXext
+, libXft
+, libXinerama
+, libXmu
+, libXpm
+, libXrandr
+, libXres
+, libexif
+, libjpeg
+, libpng
+, libtiff
+, giflib
+, libwebp
+, pango
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "windowmaker";
+  version = "0.96.0";
+
+  src = fetchFromRepoOrCz {
+    repo = "wmaker-crm";
+    rev = "wmaker-${finalAttrs.version}";
+    hash = "sha256-6DS5KztCNWPQL6/qJ5vlkOup2ourxSNf6LLTFYpPWi8=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    giflib
+    imagemagick
+    libX11
+    libXext
+    libXft
+    libXinerama
+    libXmu
+    libXpm
+    libXrandr
+    libXres
+    libexif
+    libjpeg
+    libpng
+    libtiff
+    libwebp
+    pango
+  ];
+
+  configureFlags = [
+    "--enable-modelock"
+    "--enable-randr"
+    "--enable-webp"
+    "--with-x"
+  ];
+
+  meta = {
+    homepage = "http://windowmaker.org/";
+    description = "NeXTSTEP-like window manager";
+    longDescription = ''
+      Window Maker is an X11 window manager originally designed to provide
+      integration support for the GNUstep Desktop Environment. In every way
+      possible, it reproduces the elegant look and feel of the NEXTSTEP user
+      interface. It is fast, feature rich, easy to configure, and easy to
+      use. It is also free software, with contributions being made by
+      programmers from around the world.
+    '';
+    changelog = "https://www.windowmaker.org/news/";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "wmaker";
+    maintainers = [ lib.maintainers.AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/desktops/expidus/file-manager/default.nix b/pkgs/desktops/expidus/file-manager/default.nix
index ef6d96e52300..e3c643604951 100644
--- a/pkgs/desktops/expidus/file-manager/default.nix
+++ b/pkgs/desktops/expidus/file-manager/default.nix
@@ -1,17 +1,21 @@
 { lib, flutter, fetchFromGitHub }:
 flutter.buildFlutterApplication rec {
   pname = "expidus-file-manager";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "ExpidusOS";
     repo = "file-manager";
     rev = version;
-    hash = "sha256-p/bKVC1LpvVcyI3NYjQ//QL/6UutjVg649IZSmz4w9g=";
+    hash = "sha256-R6eszy4Dz8tAPRTwZzRiZWIgVMiGv5zlhFB/HcD6gqg=";
   };
 
+  flutterBuildFlags = [
+    "--dart-define=COMMIT_HASH=b4181b9cff18a07e958c81d8f41840d2d36a6705"
+  ];
+
   depsListFile = ./deps.json;
-  vendorHash = "sha256-7d8hsqXD7oqUN8VjQczSCyqytubDRq0os8wGnOfdSvs=";
+  vendorHash = "sha256-JFAX8Tq4vhX801WAxMrsc20tsSrwQhQduYCkeU67OTw=";
 
   postInstall = ''
     rm $out/bin/file_manager
diff --git a/pkgs/desktops/expidus/file-manager/deps.json b/pkgs/desktops/expidus/file-manager/deps.json
index fa04b354c065..28df9f288480 100644
--- a/pkgs/desktops/expidus/file-manager/deps.json
+++ b/pkgs/desktops/expidus/file-manager/deps.json
@@ -1,7 +1,7 @@
 [
   {
     "name": "file_manager",
-    "version": "0.2.0+65656565656565",
+    "version": "0.2.1+65656565656565",
     "kind": "root",
     "source": "root",
     "dependencies": [
@@ -38,7 +38,7 @@
   },
   {
     "name": "flutter_lints",
-    "version": "2.0.1",
+    "version": "2.0.2",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -301,7 +301,7 @@
   },
   {
     "name": "ffi",
-    "version": "2.0.2",
+    "version": "2.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": []
@@ -319,7 +319,7 @@
   },
   {
     "name": "plugin_platform_interface",
-    "version": "2.1.4",
+    "version": "2.1.5",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -375,7 +375,7 @@
   },
   {
     "name": "flutter_adaptive_scaffold",
-    "version": "0.1.5",
+    "version": "0.1.6",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -384,7 +384,7 @@
   },
   {
     "name": "flutter_markdown",
-    "version": "0.6.15",
+    "version": "0.6.17+1",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -396,7 +396,7 @@
   },
   {
     "name": "markdown",
-    "version": "7.1.0",
+    "version": "7.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -493,7 +493,7 @@
   },
   {
     "name": "sentry_flutter",
-    "version": "7.7.0",
+    "version": "7.9.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -506,7 +506,7 @@
   },
   {
     "name": "sentry",
-    "version": "7.7.0",
+    "version": "7.9.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -536,7 +536,7 @@
   },
   {
     "name": "path_provider_platform_interface",
-    "version": "2.0.6",
+    "version": "2.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -554,7 +554,7 @@
   },
   {
     "name": "path_provider_windows",
-    "version": "2.1.7",
+    "version": "2.2.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -567,7 +567,7 @@
   },
   {
     "name": "permission_handler",
-    "version": "10.3.0",
+    "version": "10.4.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -581,7 +581,7 @@
   },
   {
     "name": "permission_handler_platform_interface",
-    "version": "3.10.0",
+    "version": "3.11.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -592,7 +592,7 @@
   },
   {
     "name": "permission_handler_windows",
-    "version": "0.1.2",
+    "version": "0.1.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -602,7 +602,7 @@
   },
   {
     "name": "permission_handler_apple",
-    "version": "9.1.0",
+    "version": "9.1.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -612,7 +612,7 @@
   },
   {
     "name": "permission_handler_android",
-    "version": "10.2.3",
+    "version": "10.3.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -632,7 +632,7 @@
   },
   {
     "name": "shared_preferences",
-    "version": "2.1.2",
+    "version": "2.2.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -647,7 +647,7 @@
   },
   {
     "name": "shared_preferences_windows",
-    "version": "2.2.0",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -661,7 +661,7 @@
   },
   {
     "name": "shared_preferences_platform_interface",
-    "version": "2.2.0",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -681,7 +681,7 @@
   },
   {
     "name": "shared_preferences_web",
-    "version": "2.1.0",
+    "version": "2.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -692,7 +692,7 @@
   },
   {
     "name": "shared_preferences_linux",
-    "version": "2.2.0",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -706,7 +706,7 @@
   },
   {
     "name": "path_provider_linux",
-    "version": "2.1.11",
+    "version": "2.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -719,29 +719,17 @@
   },
   {
     "name": "xdg_directories",
-    "version": "1.0.0",
+    "version": "1.0.2",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
       "meta",
-      "path",
-      "process"
-    ]
-  },
-  {
-    "name": "process",
-    "version": "4.2.4",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "file",
-      "path",
-      "platform"
+      "path"
     ]
   },
   {
     "name": "shared_preferences_foundation",
-    "version": "2.2.2",
+    "version": "2.3.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -751,7 +739,7 @@
   },
   {
     "name": "shared_preferences_android",
-    "version": "2.1.4",
+    "version": "2.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -860,7 +848,7 @@
   },
   {
     "name": "url_launcher",
-    "version": "6.1.11",
+    "version": "6.1.12",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -876,7 +864,7 @@
   },
   {
     "name": "url_launcher_windows",
-    "version": "3.0.6",
+    "version": "3.0.7",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -886,7 +874,7 @@
   },
   {
     "name": "url_launcher_platform_interface",
-    "version": "2.1.2",
+    "version": "2.1.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -896,7 +884,7 @@
   },
   {
     "name": "url_launcher_web",
-    "version": "2.0.17",
+    "version": "2.0.18",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -907,7 +895,7 @@
   },
   {
     "name": "url_launcher_macos",
-    "version": "3.0.5",
+    "version": "3.0.6",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -937,7 +925,7 @@
   },
   {
     "name": "url_launcher_android",
-    "version": "6.0.35",
+    "version": "6.0.38",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -947,7 +935,7 @@
   },
   {
     "name": "path_provider",
-    "version": "2.0.15",
+    "version": "2.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -961,7 +949,7 @@
   },
   {
     "name": "path_provider_foundation",
-    "version": "2.2.3",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -971,7 +959,7 @@
   },
   {
     "name": "path_provider_android",
-    "version": "2.0.27",
+    "version": "2.1.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
diff --git a/pkgs/development/compilers/rust/1_72.nix b/pkgs/development/compilers/rust/1_72.nix
index 077d8ac903fd..05e55d24a75a 100644
--- a/pkgs/development/compilers/rust/1_72.nix
+++ b/pkgs/development/compilers/rust/1_72.nix
@@ -57,4 +57,4 @@ import ./default.nix {
   rustcPatches = [ ];
 }
 
-(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildBuild" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
+(builtins.removeAttrs args [ "pkgsBuildTarget" "pkgsBuildHost" "llvmPackages_16" "llvm_16"])
diff --git a/pkgs/development/compilers/rust/cargo_cross.nix b/pkgs/development/compilers/rust/cargo_cross.nix
new file mode 100644
index 000000000000..ba7651e63bdb
--- /dev/null
+++ b/pkgs/development/compilers/rust/cargo_cross.nix
@@ -0,0 +1,14 @@
+{ runCommand, stdenv, lib, pkgsBuildBuild, makeShellWrapper, rustc, ... }:
+
+runCommand "${stdenv.targetPlatform.config}-cargo-${lib.getVersion pkgsBuildBuild.cargo}" {
+  # Use depsBuildBuild or it tries to use target-runtimeShell
+  depsBuildBuild = [ makeShellWrapper ];
+
+  inherit (pkgsBuildBuild.cargo) meta;
+} ''
+  mkdir -p $out/bin
+  ln -s ${pkgsBuildBuild.cargo}/share $out/share
+
+  makeWrapper "${pkgsBuildBuild.cargo}/bin/cargo" "$out/bin/cargo" \
+    --prefix PATH : "${rustc}/bin"
+ ''
diff --git a/pkgs/development/compilers/rust/default.nix b/pkgs/development/compilers/rust/default.nix
index 77c8b3d592fa..90e921651f14 100644
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@@ -15,12 +15,15 @@
 , buildPackages
 , newScope, callPackage
 , CoreFoundation, Security, SystemConfiguration
+, pkgsBuildBuild
 , makeRustPlatform
 }:
 
 let
   # Use `import` to make sure no packages sneak in here.
   lib' = import ../../../build-support/rust/lib { inherit lib; };
+  # Allow faster cross compiler generation by reusing Build artifacts
+  fastCross = (stdenv.buildPlatform == stdenv.hostPlatform) && (stdenv.hostPlatform != stdenv.targetPlatform);
 in
 {
   lib = lib';
@@ -48,7 +51,10 @@ in
       # Like `buildRustPackages`, but may also contain prebuilt binaries to
       # break cycle. Just like `bootstrapTools` for nixpkgs as a whole,
       # nothing in the final package set should refer to this.
-      bootstrapRustPackages = self.buildRustPackages.overrideScope (_: _:
+      bootstrapRustPackages = if fastCross
+      then pkgsBuildBuild.rustPackages
+      else
+        self.buildRustPackages.overrideScope (_: _:
         lib.optionalAttrs (stdenv.buildPlatform == stdenv.hostPlatform)
           (selectRustPackage buildPackages).packages.prebuilt);
       bootRustPlatform = makeRustPlatform bootstrapRustPackages;
@@ -61,7 +67,7 @@ in
         version = rustcVersion;
         sha256 = rustcSha256;
         inherit enableRustcDev;
-        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackages;
+        inherit llvmShared llvmSharedForBuild llvmSharedForHost llvmSharedForTarget llvmPackages fastCross;
 
         patches = rustcPatches;
 
@@ -72,11 +78,11 @@ in
         inherit Security;
         inherit (self.buildRustPackages) rustc;
       };
-      cargo = self.callPackage ./cargo.nix {
+      cargo = if (!fastCross) then self.callPackage ./cargo.nix {
         # Use boot package set to break cycle
         rustPlatform = bootRustPlatform;
         inherit CoreFoundation Security;
-      };
+      } else self.callPackage ./cargo_cross.nix {};
       cargo-auditable = self.callPackage ./cargo-auditable.nix { };
       cargo-auditable-cargo-wrapper = self.callPackage ./cargo-auditable-cargo-wrapper.nix { };
       clippy = self.callPackage ./clippy.nix {
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 53f7257ecfc5..869dd15df0be 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -15,6 +15,10 @@
 , wezterm
 , firefox
 , thunderbird
+# This only builds std for target and reuses the rustc from build.
+, fastCross
+, lndir
+, makeWrapper
 }:
 
 let
@@ -87,13 +91,13 @@ in stdenv.mkDerivation rec {
     # (build!=target): When cross-building a compiler we need to add
     # the build platform as well so rustc can compile build.rs
     # scripts.
-    ] ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform) [
+    ] ++ optionals (stdenv.buildPlatform != stdenv.targetPlatform && !fastCross) [
       (rust.toRustTargetSpec stdenv.buildPlatform)
 
     # (host!=target): When building a cross-targeting compiler we
     # need to add the host platform as well so rustc can compile
     # build.rs scripts.
-    ] ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform) [
+    ] ++ optionals (stdenv.hostPlatform != stdenv.targetPlatform && !fastCross) [
       (rust.toRustTargetSpec stdenv.hostPlatform)
     ])}"
 
@@ -132,6 +136,37 @@ in stdenv.mkDerivation rec {
     "--set rust.jemalloc"
   ];
 
+  # if we already have a rust compiler for build just compile the target std
+  # library and reuse compiler
+  buildPhase = if fastCross then "
+    runHook preBuild
+
+    mkdir -p build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-{std,rustc}/${rust.toRustTargetSpec stdenv.hostPlatform}/release/
+    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/libstd-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/libstd.so
+    ln -s ${rustc}/lib/rustlib/${rust.toRustTargetSpec stdenv.hostPlatform}/librustc_driver-*.so build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/librustc.so
+    ln -s ${rustc}/bin/rustc build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/rustc-main
+    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-std/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.libstd.stamp
+    touch build/${rust.toRustTargetSpec stdenv.hostPlatform}/stage0-rustc/${rust.toRustTargetSpec stdenv.hostPlatform}/release/.librustc.stamp
+    python ./x.py --keep-stage=0 --stage=1 build library/std
+
+    runHook postBuild
+  " else null;
+
+  installPhase = if fastCross then ''
+    runHook preInstall
+
+    python ./x.py --keep-stage=0 --stage=1 install library/std
+    mkdir -v $out/bin $doc $man
+    makeWrapper ${rustc}/bin/rustc $out/bin/rustc --add-flags "--sysroot $out"
+    makeWrapper ${rustc}/bin/rustdoc $out/bin/rustdoc --add-flags "--sysroot $out"
+    ln -s ${rustc}/lib/rustlib/{manifest-rust-std-,}${rust.toRustTargetSpec stdenv.hostPlatform} $out/lib/rustlib/
+    echo rust-std-${rust.toRustTargetSpec stdenv.hostPlatform} >> $out/lib/rustlib/components
+    lndir ${rustc.doc} $doc
+    lndir ${rustc.man} $man
+
+    runHook postInstall
+  '' else null;
+
   # The bootstrap.py will generated a Makefile that then executes the build.
   # The BOOTSTRAP_ARGS used by this Makefile must include all flags to pass
   # to the bootstrap builder.
@@ -179,7 +214,8 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [
     file python3 rustc cmake
     which libffi removeReferencesTo pkg-config xz
-  ];
+  ]
+    ++ optionals fastCross [ lndir makeWrapper ];
 
   buildInputs = [ openssl ]
     ++ optionals stdenv.isDarwin [ libiconv Security ]
@@ -188,7 +224,7 @@ in stdenv.mkDerivation rec {
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
 
-  postInstall = lib.optionalString enableRustcDev ''
+  postInstall = lib.optionalString (enableRustcDev && !fastCross) ''
     # install rustc-dev components. Necessary to build rls, clippy...
     python x.py dist rustc-dev
     tar xf build/dist/rustc-dev*tar.gz
diff --git a/pkgs/development/embedded/blisp/default.nix b/pkgs/development/embedded/blisp/default.nix
index 9758b6a2bc39..fa3adc2fdf22 100644
--- a/pkgs/development/embedded/blisp/default.nix
+++ b/pkgs/development/embedded/blisp/default.nix
@@ -5,18 +5,19 @@
 , cmake
 , libserialport
 , pkg-config
+, testers
 , IOKit
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "blisp";
-  version = "unstable-2023-06-03";
+  version = "0.0.4";
 
   src = fetchFromGitHub {
     owner = "pine64";
     repo = "blisp";
-    rev = "048a72408218788d519a87bcdfb23bcf9ed91a84";
-    hash = "sha256-hipJrr0D4uEN2hk8ooXeg0gv0X3w4U9ReXbC4oPEPwI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-cN35VLbdQFA3KTZ8PxgpbsLGXqfFhw5eh3nEBRZqAm4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -31,12 +32,16 @@ stdenv.mkDerivation {
     "-DBLISP_USE_SYSTEM_LIBRARIES=ON"
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
+  };
+
   meta = with lib; {
-    description = "ISP tool & library for Bouffalo Labs RISC-V Microcontrollers and SoCs";
+    description = "An In-System-Programming (ISP) tool & library for Bouffalo Labs RISC-V Microcontrollers and SoCs";
     license = licenses.mit;
+    mainProgram = "blisp";
     homepage = "https://github.com/pine64/blisp";
     maintainers = [ maintainers.fortuneteller2k ];
   };
-}
-# TODO: update when next stable release supports building without vendored
-# libraries
+})
diff --git a/pkgs/development/libraries/SDL2_ttf/default.nix b/pkgs/development/libraries/SDL2_ttf/default.nix
index 66f53949c245..d2dd8d53929e 100644
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, pkg-config, darwin, fetchurl, SDL2, freetype, libGL }:
+{ lib, stdenv, pkg-config, darwin, fetchurl, SDL2, freetype, harfbuzz, libGL }:
 
 stdenv.mkDerivation rec {
   pname = "SDL2_ttf";
@@ -9,11 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ncce2TSHUhsQeixKnKa/Q/ti9r3dXCawVea5FBiiIFM=";
   };
 
-  configureFlags = lib.optional stdenv.isDarwin "--disable-sdltest";
+  configureFlags = [ "--disable-harfbuzz-builtin" ]
+    ++ lib.optionals stdenv.isDarwin [ "--disable-sdltest" ];
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ SDL2 freetype ]
+  buildInputs = [ SDL2 freetype harfbuzz ]
     ++ lib.optional (!stdenv.isDarwin) libGL
     ++ lib.optional stdenv.isDarwin darwin.libobjc;
 
diff --git a/pkgs/development/libraries/level-zero/default.nix b/pkgs/development/libraries/level-zero/default.nix
index c213e75d5f2d..0c953b8d8710 100644
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.13.5";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XpLbbcB8M63q+0Vj7NrERSXVIjy5KQrVZMvYijUbJhw=";
+    hash = "sha256-7hFGY255dLgDo93+Nx2we/cfEtwaiaajdVg1VTst1/U=";
   };
 
   nativeBuildInputs = [ cmake addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index b9d31c6fd874..3863710f3c8c 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -66,16 +66,16 @@ let
       projectArch = "x86_64";
     };
   };
-  platforms."aarch64-linux".sha256 = "0ij7y0whlq8g1sskbhirbw3ngbp95k1in2pi9kjhb9flydjwxq8g";
-  platforms."x86_64-linux".sha256 = "0dyv1ddsakxi51a7iwmy006mx27gvjq49i45difkmjv6mw9s2fw9";
+  platforms."aarch64-linux".sha256 = "0xzgcnh45x3sqg0jndp9g08zy9bvzvmvfz8imj12j55vkm6f7kl6";
+  platforms."x86_64-linux".sha256 = "1942mwlyrz5pxlx9kcnz85rqbz8q8slkivx0001z30l7a6pizgg5";
 
   platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms;
 in
 stdenv.mkDerivation rec {
   pname = "cef-binary";
-  version = "116.0.15";
-  gitRevision = "0b8c265";
-  chromiumVersion = "116.0.5845.111";
+  version = "116.0.20";
+  gitRevision = "d6abd3c";
+  chromiumVersion = "116.0.5845.180";
 
   src = fetchurl {
     url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";
diff --git a/pkgs/development/libraries/mpir/default.nix b/pkgs/development/libraries/mpir/default.nix
index 8ccad867ea89..6dd105bdb302 100644
--- a/pkgs/development/libraries/mpir/default.nix
+++ b/pkgs/development/libraries/mpir/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, m4, which, yasm, buildPackages }:
+{ lib, stdenv, fetchurl, m4, which, yasm, autoreconfHook, fetchpatch, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "mpir";
@@ -6,13 +6,22 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [ m4 which yasm ];
+  nativeBuildInputs = [ m4 which yasm autoreconfHook ];
 
   src = fetchurl {
     url = "https://mpir.org/mpir-${version}.tar.bz2";
     sha256 = "1fvmhrqdjs925hzr2i8bszm50h00gwsh17p2kn2pi51zrxck9xjj";
   };
 
+  patches = [
+    # Fixes configure check failures with clang 16 due to implicit definitions of `exit`, which
+    # is an error with newer versions of clang.
+    (fetchpatch {
+      url = "https://github.com/wbhart/mpir/commit/bbc43ca6ae0bec4f64e69c9cd4c967005d6470eb.patch";
+      hash = "sha256-vW+cDK5Hq2hKEyprOJaNbj0bT2FJmMcyZHPE8GUNUWc=";
+    })
+  ];
+
   configureFlags = [ "--enable-cxx" ]
     ++ lib.optionals stdenv.isLinux [ "--enable-fat" ];
 
diff --git a/pkgs/development/libraries/open62541/default.nix b/pkgs/development/libraries/open62541/default.nix
index fb67d66018f7..e25ac7bfca51 100644
--- a/pkgs/development/libraries/open62541/default.nix
+++ b/pkgs/development/libraries/open62541/default.nix
@@ -31,13 +31,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open62541";
-  version = "1.3.6";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "open62541";
     repo = "open62541";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cmD01D49pHEHN0QQtE5RXv0YZ/MPIWnubeUY6BH4DrU=";
+    hash = "sha256-XmoLmBGTMA6cejLiNU8hAVnHd35eh6lTIu9csmiR+4U=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/spdlog/default.nix b/pkgs/development/libraries/spdlog/default.nix
index fe648a2ce7bf..d68e22f1c891 100644
--- a/pkgs/development/libraries/spdlog/default.nix
+++ b/pkgs/development/libraries/spdlog/default.nix
@@ -3,10 +3,8 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake
-# Although we include upstream patches that fix compilation with fmt_10, we
-# still use fmt_9 because this dependency is propagated, and many of spdlog's
-# reverse dependencies don't support fmt_10 yet.
-, fmt_9
+, fmt
+, catch2_3
 , staticBuild ? stdenv.hostPlatform.isStatic
 
 # tests
@@ -15,29 +13,26 @@
 
 stdenv.mkDerivation rec {
   pname = "spdlog";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "gabime";
     repo  = "spdlog";
     rev   = "v${version}";
-    hash  = "sha256-kA2MAb4/EygjwiLEjF9EA7k8Tk//nwcKB1+HlzELakQ=";
+    hash  = "sha256-cxTaOuLXHRU8xMz9gluYz0a93O0ez2xOxbloyc1m1ns=";
   };
 
   patches = [
-    # Fix compatiblity with fmt 10.0. Remove with the next release
+    # Fix a broken test, remove with the next release.
     (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/0ca574ae168820da0268b3ec7607ca7b33024d05.patch";
-      hash = "sha256-cRsQilkyUQW47PFpDwKgU/pm+tOeLvwPx32gNOPAO1U=";
-    })
-    (fetchpatch {
-      url = "https://github.com/gabime/spdlog/commit/af1785b897c9d1098d4aa7213fad232be63c19b4.patch";
-      hash = "sha256-zpfLiBeDAOsvk4vrIyXC0kvFe2WkhAhersd+fhA8DFY=";
+      url = "https://github.com/gabime/spdlog/commit/2ee8bac78e6525a8ad9a9196e65d502ce390d83a.patch";
+      hash = "sha256-L79yOkm3VY01jmxNctfneTLmOA5DEQeNNGC8LbpJiOc=";
     })
   ];
 
   nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ fmt_9 ];
+  propagatedBuildInputs = [ fmt ];
+  checkInputs = [ catch2_3 ];
 
   cmakeFlags = [
     "-DSPDLOG_BUILD_SHARED=${if staticBuild then "OFF" else "ON"}"
diff --git a/pkgs/development/libraries/wfa2-lib/default.nix b/pkgs/development/libraries/wfa2-lib/default.nix
new file mode 100644
index 000000000000..9555b9faea60
--- /dev/null
+++ b/pkgs/development/libraries/wfa2-lib/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, llvmPackages
+, enableOpenMP ? true
+}:
+
+stdenv.mkDerivation rec {
+  pname = "wfa2-lib";
+  version = "2.3.3";
+
+  src = fetchFromGitHub {
+    owner = "smarco";
+    repo = "WFA2-lib";
+    rev = "v${version}";
+    hash = "sha256-PLZhxKMBhKm6E/ENFZ/yWMWIwJG5voaJls2in44OGoQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals enableOpenMP [ llvmPackages.openmp ];
+
+  cmakeFlags = [ "-DOPENMP=${if enableOpenMP then "ON" else "OFF"}" ];
+
+  meta = with lib; {
+    description = "Wavefront alignment algorithm library v2";
+    homepage = "https://github.com/smarco/WFA2-lib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rs0vere ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index 2a563397656a..9cefb46d8e67 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -2,11 +2,11 @@
 
 mkDerivation (finalAttrs: {
   pname = "composer";
-  version = "2.5.8";
+  version = "2.6.2";
 
   src = fetchurl {
     url = "https://github.com/composer/composer/releases/download/${finalAttrs.version}/composer.phar";
-    hash = "sha256-8Hk0+tRPkEjA3IdaUGzKMcwnlNauv8GGfzsfv0jc4sU=";
+    hash = "sha256-iMhNSlP88cJ9Z2Lh1da3DVfG3J0uIxT9Cdv4a/YeGu8=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/aiodiscover/default.nix b/pkgs/development/python-modules/aiodiscover/default.nix
index 0e5897391038..3a7af196d172 100644
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiodiscover";
-  version = "1.4.16";
+  version = "1.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-umHw9DFLIsoxBNlUSuSmaRy5O270lP0tLZ8rilw0oWg=";
+    hash = "sha256-rFypv0gCj+Jskk+dlRNJ2ufj2sDud7AuJzj3cl4bB4Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiovodafone/default.nix b/pkgs/development/python-modules/aiovodafone/default.nix
index f0ad237f9208..46e635fce012 100644
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "aiovodafone";
-  version = "0.0.8";
+  version = "0.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "chemelli74";
     repo = "aiovodafone";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o21zaK3dJfURFAt8fPaOd95H7tuqLnFPC01RGHBIz4M=";
+    hash = "sha256-VO+lQK+0bSQqnFiLzRMnVTpTJRjv2fZhDbIoTiMFWFI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bleak-retry-connector/default.nix b/pkgs/development/python-modules/bleak-retry-connector/default.nix
index 401037eb3dd7..5e84af2a53b7 100644
--- a/pkgs/development/python-modules/bleak-retry-connector/default.nix
+++ b/pkgs/development/python-modules/bleak-retry-connector/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bleak-retry-connector";
-  version = "3.1.2";
+  version = "3.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-q+J4PUBm42jBcLbiywWwDZxUI0Gsl8GjnLPwniWp+Kw=";
+    hash = "sha256-Nd/9mUtEEhCiJSF677lsE5UhMrbWiIl3ktQ7FjtyYlQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 13b335d02617..61a069305d13 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bleak";
-  version = "0.21.0";
+  version = "0.21.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "hbldh";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-hnXBXm0BFNNzw563Ybr76KHiqt2sFqo0dtiRHGWsu3A=";
+    hash = "sha256-T0im8zKyNLbskAEDeUUFS/daJtvttlHlttjscqP8iSk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index b631846b5e43..f681ca357d81 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.16.0";
+  version = "0.16.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gbnsTRiT/4YumyaJ1h4VRzDAf8/oSkD3yL9mdACvWWk=";
+    hash = "sha256-GJhrL6J/L1+tqa7fN5xwE+8IFZZ9kff2g+04H5M7beY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
index c76e979f97d3..b9cd8bec9f08 100644
--- a/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
+++ b/pkgs/development/python-modules/bluetooth-auto-recovery/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-auto-recovery";
-  version = "1.2.1";
+  version = "1.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5OOIehWb7nxKs1AF9/0yjZhbc3h4MWdgAVCa7irq5YE=";
+    hash = "sha256-1ytiTIAV00Wk2zqZKRAsstVLuyzPEGBISz0g0ssC5Eo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/checkdmarc/default.nix b/pkgs/development/python-modules/checkdmarc/default.nix
new file mode 100644
index 000000000000..e7cedec9791b
--- /dev/null
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -0,0 +1,76 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, dnspython
+, expiringdict
+, fetchFromGitHub
+, hatchling
+, publicsuffixlist
+, pyleri
+, iana-etc
+, pytestCheckHook
+, pythonOlder
+, requests
+, timeout-decorator
+}:
+
+buildPythonPackage rec {
+  pname = "checkdmarc";
+  version = "4.8.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "domainaware";
+    repo = "checkdmarc";
+    # https://github.com/domainaware/checkdmarc/issues/102
+    rev = "d0364ceef3cfd41052273913369e3831cb6fe4fd";
+    hash = "sha256-OSljewDeyJtoxkCQjPU9wIsNhhxumHmeu9GHvRD4DRY=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+    dnspython
+    expiringdict
+    publicsuffixlist
+    pyleri
+    requests
+    timeout-decorator
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "checkdmarc"
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "testDMARCPctLessThan100Warning"
+    "testSPFMissingARecord"
+    "testSPFMissingMXRecord"
+    "testSplitSPFRecord"
+    "testTooManySPFDNSLookups"
+    "testTooManySPFVoidDNSLookups"
+  ];
+
+  meta = with lib; {
+    description = "A parser for SPF and DMARC DNS records";
+    homepage = "https://github.com/domainaware/checkdmarc";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
+
diff --git a/pkgs/development/python-modules/cson/default.nix b/pkgs/development/python-modules/cson/default.nix
index c05ad78240c0..4c1b63946ad2 100644
--- a/pkgs/development/python-modules/cson/default.nix
+++ b/pkgs/development/python-modules/cson/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ speg ];
 
-  pythonImportChecks = [ "cson" ];
+  pythonImportsCheck = [ "cson" ];
 
   meta = with lib; {
     description = "A python parser for the Coffeescript Object Notation (CSON)";
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index bec651629d7f..d511ccfb12fa 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Dzr7CSoJhO/F75Ro686lKXCOzP2AxtR6wJOp70IOvUk=";
+    hash = "sha256-gaV9IbifHlxY0d8sDvWnRBDyOnWc4gqsRHTgeyyeVQs=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/diffsync/default.nix b/pkgs/development/python-modules/diffsync/default.nix
new file mode 100644
index 000000000000..81c3b5c7eda4
--- /dev/null
+++ b/pkgs/development/python-modules/diffsync/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, colorama
+, fetchFromGitHub
+, packaging
+, poetry-core
+, pydantic
+, redis
+, structlog
+}:
+
+buildPythonPackage rec {
+  pname = "diffsync";
+  version = "1.8.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "networktocode";
+    repo = "diffsync";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2OhckgJK1qimF0AcYSa8L+AkzfiN5VojWj0x6kwbgyk=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    colorama
+    packaging
+    pydantic
+    redis
+    structlog
+  ];
+
+  pythonImportsCheck = [
+    "diffsync"
+  ];
+
+  meta = with lib; {
+    description = "Utility library for comparing and synchronizing different datasets";
+    homepage = "https://github.com/networktocode/diffsync";
+    changelog = "https://github.com/networktocode/diffsync/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ clerie ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-admin-datta/default.nix b/pkgs/development/python-modules/django-admin-datta/default.nix
index 795a86d34bf2..44be722da51a 100644
--- a/pkgs/development/python-modules/django-admin-datta/default.nix
+++ b/pkgs/development/python-modules/django-admin-datta/default.nix
@@ -24,8 +24,8 @@ buildPythonPackage rec {
   # no tests
   doCheck = false;
 
-  pythonImportCheck = [
-    "admin-datta"
+  pythonImportsCheck = [
+    "admin_datta"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index 3f4b8464cf8f..2e1c93f89c04 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -17,15 +17,15 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.21.5";
+  version = "0.21.6";
   pname = "dulwich";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cJVeTiSd3abjSkY2uQ906THlWPmTsXxSVw+mFEuZMQM=";
+    hash = "sha256-MPvofotR84E8Ex4oQchtAHQ00WC9FttYa0DUfzHdBbA=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 09ae0a82d634..65ad409aaee3 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.16.0";
+  version = "2.16.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pLagCMHxlN26x/zP6tDRchxTwqvRyARKO5EzmuWncUo=";
+    hash = "sha256-hnKOSo/RUzGnj7JbdKOGogVN925LZQiL3uvy5+dQfPw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 0ffe4d40195b..2ceea8047274 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.18.0";
+  version = "2.18.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+bJbtqBUgix4oIq49hQEk3/cNXfvXFXE/m/qR1zy8jo=";
+    hash = "sha256-XxQGkcwWesPS/N31t04FDq6w773OZnLVTWB42dY4AGA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flask-socketio/default.nix b/pkgs/development/python-modules/flask-socketio/default.nix
index 71a8ed656bcb..53a793c75f5a 100644
--- a/pkgs/development/python-modules/flask-socketio/default.nix
+++ b/pkgs/development/python-modules/flask-socketio/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "Flask-SocketIO";
-  version = "5.3.5";
+  version = "5.3.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "miguelgrinberg";
     repo = "Flask-SocketIO";
-    rev = "v${version}";
-    hash = "sha256-5Di02VJM9sJndp/x5Hl9ztcItY3aXk/wBJT90OSoc2c=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-YjCe34Mvt7tvp3w5yH52lrq4bWi7aIYAUssNqxlQ8CA=";
   };
 
   nativeBuildInputs = [
@@ -41,13 +41,15 @@ buildPythonPackage rec {
     "test_socketio.py"
   ];
 
-  pythonImportsCheck = [ "flask_socketio" ];
+  pythonImportsCheck = [
+    "flask_socketio"
+  ];
 
   meta = with lib; {
     description = "Socket.IO integration for Flask applications";
     homepage = "https://github.com/miguelgrinberg/Flask-SocketIO/";
     changelog = "https://github.com/miguelgrinberg/Flask-SocketIO/blob/v${version}/CHANGES.md";
     license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 ];
   };
 }
diff --git a/pkgs/development/python-modules/geventhttpclient/default.nix b/pkgs/development/python-modules/geventhttpclient/default.nix
index 21638ce80311..906fcdbdb608 100644
--- a/pkgs/development/python-modules/geventhttpclient/default.nix
+++ b/pkgs/development/python-modules/geventhttpclient/default.nix
@@ -8,19 +8,20 @@
 , pytestCheckHook
 , pythonOlder
 , six
+, stdenv
 , urllib3
 }:
 
 buildPythonPackage rec {
   pname = "geventhttpclient";
-  version = "2.0.8";
+  version = "2.0.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-X3gsQZZD90vk0JGMDStjlW723ceiEn8Hy7gDOnWrNm8=";
+    hash = "sha256-t8l7JlEZV6NqiU7FRlHAiJCmnhGLaXVfjnS/w3xjORs=";
   };
 
   propagatedBuildInputs = [
@@ -36,6 +37,9 @@ buildPythonPackage rec {
     urllib3
   ];
 
+  # lots of: [Errno 48] Address already in use: ('127.0.0.1', 54323)
+  doCheck = !stdenv.isDarwin;
+
   __darwinAllowLocalNetworking = true;
 
   disabledTests = [
@@ -56,6 +60,7 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/geventhttpclient/geventhttpclient";
     description = "High performance, concurrent HTTP client library using gevent";
+    changelog = "https://github.com/geventhttpclient/geventhttpclient/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ koral ];
   };
diff --git a/pkgs/development/python-modules/greeneye-monitor/default.nix b/pkgs/development/python-modules/greeneye-monitor/default.nix
index 3efc25274d93..38f9dea75455 100644
--- a/pkgs/development/python-modules/greeneye-monitor/default.nix
+++ b/pkgs/development/python-modules/greeneye-monitor/default.nix
@@ -4,28 +4,27 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , siobrultech-protocols
 }:
 
 buildPythonPackage rec {
   pname = "greeneye-monitor";
-  version = "4.0.1";
+  version = "5.0";
+  format = "pyproject";
 
   disabled = pythonOlder "3.10";
 
-  format = "setuptools";
-
   src = fetchFromGitHub {
     owner = "jkeljo";
     repo = "greeneye-monitor";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S/1MT9ZQ9G0F1WXqzNKhVo8vtfPLzr8WRlfYc7TU9iQ=";
+    hash = "sha256-HU+GWO08caKfQZ0tIDmJYAML4CKUM0CPukm7wD6uSEA=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "siobrultech_protocols==" "siobrultech_protocols>="
-  '';
+  nativeBuildInputs = [
+    setuptools
+  ];
 
   propagatedBuildInputs = [
     aiohttp
diff --git a/pkgs/development/python-modules/liccheck/default.nix b/pkgs/development/python-modules/liccheck/default.nix
new file mode 100644
index 000000000000..0af550ef6f89
--- /dev/null
+++ b/pkgs/development/python-modules/liccheck/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, configparser
+, fetchFromGitHub
+, pip
+, pytest-mock
+, pytestCheckHook
+, python3-openid
+, pythonOlder
+, semantic-version
+, toml
+}:
+
+buildPythonPackage rec {
+  pname = "liccheck";
+  version = "0.9.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "dhatim";
+    repo = "python-license-check";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZgwHcZI0vsNYJWPkUnoBogVPPIuifAX9hu4fa1fHSz4=";
+  };
+
+  propagatedBuildInputs = [
+    configparser
+    semantic-version
+    toml
+  ];
+
+  nativeCheckInputs = [
+    pip
+    pytest-mock
+    pytestCheckHook
+    python3-openid
+  ];
+
+  pythonImportsCheck = [
+    "liccheck"
+  ];
+
+  meta = with lib; {
+    description = "Check python packages from requirement.txt and report issues";
+    homepage = "https://github.com/dhatim/python-license-check";
+    changelog = "https://github.com/dhatim/python-license-check/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/locationsharinglib/default.nix b/pkgs/development/python-modules/locationsharinglib/default.nix
index 001a0705dab5..5f47be17a4db 100644
--- a/pkgs/development/python-modules/locationsharinglib/default.nix
+++ b/pkgs/development/python-modules/locationsharinglib/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "locationsharinglib";
-  version = "5.0.1";
+  version = "5.0.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KT/q1UIJ/DzGqz8T08MXG9UCstAcpDydM4Tkn33pruI=";
+    hash = "sha256-ydwtcIJ2trQ6xg2r5kU/ogvjdBwUZhYhBdc6nBmSGcg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-jupyter/default.nix b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
index fb0640719d5a..92470b9b4903 100644
--- a/pkgs/development/python-modules/mkdocs-jupyter/default.nix
+++ b/pkgs/development/python-modules/mkdocs-jupyter/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-jupyter";
-  version = "0.24.1";
+  version = "0.24.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "mkdocs_jupyter";
     inherit version;
-    hash = "sha256-lncDf7fpMSaPPfdZn8CCjCYSR989FXW87TILqLfR1G0=";
+    hash = "sha256-XgwQnVNdSHlyMHGbaUH00I3pWno8lb8VhmLEEvwVyy4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mutagen/default.nix b/pkgs/development/python-modules/mutagen/default.nix
index 705c3583a8c9..5843cd9432b5 100644
--- a/pkgs/development/python-modules/mutagen/default.nix
+++ b/pkgs/development/python-modules/mutagen/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
-, fetchpatch
 
 # docs
 , python
@@ -16,32 +15,26 @@
 
 buildPythonPackage rec {
   pname = "mutagen";
-  version = "1.46.0";
+  version = "1.47.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bl+LqEg2uZ/mC+X7J/hL5K2Rm7trScqmroHnBYS1Xlg=";
+    hash = "sha256-cZ+t7wqXjDG0zzyVYmGzxYtpSLMgIweKIRex3gnw/Jk=";
   };
 
-  outputs = [ "out" "doc" ];
+  outputs = [
+    "out"
+    "doc"
+  ];
 
   nativeBuildInputs = [
     sphinx
     sphinx-rtd-theme
   ];
 
-  patches = [
-    (fetchpatch {
-      # docs: Make extlinks compatible with sphinx 6.0
-      # https://github.com/quodlibet/mutagen/pull/590
-      url = "https://github.com/quodlibet/mutagen/commit/37b4e6bddc03e1f715425c418ea84bac15116907.patch";
-      hash = "sha256-CnGfHY4RhRhOLvlRTH/NZwzCnAL3VhU6xosuh6fkqGQ=";
-    })
-  ];
-
   postInstall = ''
     ${python.pythonForBuild.interpreter} setup.py build_sphinx --build-dir=$doc
   '';
diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index 3f958d05cff9..889017f006d9 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -7,13 +7,14 @@
 , nats-server
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , uvloop
 }:
 
 buildPythonPackage rec {
   pname = "nats-py";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.3.1";
+  format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
@@ -21,9 +22,18 @@ buildPythonPackage rec {
     owner = "nats-io";
     repo = "nats.py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w+YySX9RNXUttt7iLg/Efh8bNzmhIQTKMXcoPO1k4lI=";
+    hash = "sha256-vcTkQeaWBsPlPCp53VqI3inH0PkdxkKWDTW/vtrD/xw=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace '"--cov=nats", "--cov-report=html"' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
     ed25519
@@ -35,11 +45,6 @@ buildPythonPackage rec {
     uvloop
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=nats --cov-report html" ""
-  '';
-
   disabledTests = [
     # AssertionError: assert 5 == 0
     "test_pull_subscribe_limits"
diff --git a/pkgs/development/python-modules/onnx/default.nix b/pkgs/development/python-modules/onnx/default.nix
index 52e0984f5aa0..0f9b290cc28d 100644
--- a/pkgs/development/python-modules/onnx/default.nix
+++ b/pkgs/development/python-modules/onnx/default.nix
@@ -19,7 +19,7 @@ let
   gtestStatic = gtest.override { static = true; };
 in buildPythonPackage rec {
   pname = "onnx";
-  version = "1.14.0";
+  version = "1.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ in buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-f+s25Y/jGosaSdoZY6PE3j6pENkfDcD+IQndrbtuzWg=";
+    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/opcua-widgets/default.nix b/pkgs/development/python-modules/opcua-widgets/default.nix
index 386ced76a918..3034cb8fcc0f 100644
--- a/pkgs/development/python-modules/opcua-widgets/default.nix
+++ b/pkgs/development/python-modules/opcua-widgets/default.nix
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     asyncua
   ];
 
-  pythonImportChecks = [ "opcua-widgets" ];
+  pythonImportsCheck = [ "uawidgets" ];
 
   #This test is broken, when updating this package check if the test was fixed.
   doCheck = false;
diff --git a/pkgs/development/python-modules/plexapi/default.nix b/pkgs/development/python-modules/plexapi/default.nix
index f858a77704fc..c2623977be4c 100644
--- a/pkgs/development/python-modules/plexapi/default.nix
+++ b/pkgs/development/python-modules/plexapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "plexapi";
-  version = "4.15.0";
+  version = "4.15.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-JIfMHDMX7N9wr9BTiTh/jsnPLDS3w8Pyp7wS014PyQ0=";
+    hash = "sha256-mxVj98wbstUx/Abim7kzVVt/8kaAPVOhv4zt+PFgi3Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pulsectl-asyncio/default.nix b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
new file mode 100644
index 000000000000..54500916e884
--- /dev/null
+++ b/pkgs/development/python-modules/pulsectl-asyncio/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pulsectl
+, pythonOlder
+, setuptools
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "pulsectl-asyncio";
+  version = "1.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mhthies";
+    repo = "pulsectl-asyncio";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Uc8iUo9THWNPRRsvJxfw++41cnKrANe/Fk6e8bgLSkc=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    pulsectl
+  ];
+
+  # Tests require a running pulseaudio instance
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "pulsectl_asyncio"
+  ];
+
+  meta = with lib; {
+    description = "Python bindings library for PulseAudio";
+    homepage = "https://github.com/mhthies/pulsectl-asyncio";
+    changelog = "https://github.com/mhthies/pulsectl-asyncio/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyfluidsynth/default.nix b/pkgs/development/python-modules/pyfluidsynth/default.nix
new file mode 100644
index 000000000000..1e837b67129a
--- /dev/null
+++ b/pkgs/development/python-modules/pyfluidsynth/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, wheel
+, numpy
+, fluidsynth
+, stdenv
+, fetchpatch
+}:
+
+buildPythonPackage rec {
+  pname = "pyfluidsynth";
+  version = "1.3.2";
+  format = "pyproject";
+
+  src = fetchPypi {
+    pname = "pyFluidSynth";
+    inherit version;
+    hash = "sha256-+i5oOXV4UG6z4rQGuguOP0mHo7V7fJZZRwOnJKB1VfQ=";
+  };
+
+  patches = [
+    # fixes error: Unknown integer parameter 'synth.sample-rate'
+    # https://github.com/nwhitehead/pyfluidsynth/pull/44
+    (fetchpatch {
+      name = "add-fluid-synth-get-status-and-fix-some-typing-bugs.patch";
+      url = "https://github.com/nwhitehead/pyfluidsynth/commit/1b31ca6ab00930dbb515c4cc00bb31a65578b7c0.patch";
+      hash = "sha256-ZCqy7aIv5iAAJrWOD7e538xltj11gy5fakIXnAbUsu8=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  pythonImportsCheck = [ "fluidsynth" ];
+
+  postPatch = ''
+    sed -Ezi fluidsynth.py -e \
+      's|lib = .*\\\n[^\n]*|lib = "${lib.getLib fluidsynth}/lib/libfluidsynth${stdenv.hostPlatform.extensions.sharedLibrary}"|'
+  '';
+
+  meta = with lib; {
+    description = "Python bindings for FluidSynth, a MIDI synthesizer that uses SoundFont instruments";
+    homepage = "https://github.com/nwhitehead/pyfluidsynth";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyleri/default.nix b/pkgs/development/python-modules/pyleri/default.nix
new file mode 100644
index 000000000000..98c71d06f55a
--- /dev/null
+++ b/pkgs/development/python-modules/pyleri/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "pyleri";
+  version = "1.4.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "cesbit";
+    repo = "pyleri";
+    rev = "refs/tags/${version}";
+    hash = "sha256-52Q2iTrXFNbDzXL0FM+Gypipvo5ciNqAtZa5sKOwQRc=";
+  };
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pyleri"
+  ];
+
+  meta = with lib; {
+    description = "Module to parse SiriDB";
+    homepage = "https://github.com/cesbit/pyleri";
+    changelog = "https://github.com/cesbit/pyleri/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pymodbus/default.nix b/pkgs/development/python-modules/pymodbus/default.nix
index 3715cc56404d..7b172949567e 100644
--- a/pkgs/development/python-modules/pymodbus/default.nix
+++ b/pkgs/development/python-modules/pymodbus/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pymodbus";
-  version = "3.5.1";
+  version = "3.5.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pymodbus-dev";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YFA9msaPOPDbQPkDbT8Rl7jWafUX8eFnV4JimSg+mmc=";
+    hash = "sha256-FOmR9yqLagqcsAVxqHxziEcnZ5M9QpL2qIp8x2gS2PU=";
   };
 
   passthru.optional-dependencies = {
@@ -59,7 +59,14 @@ buildPythonPackage rec {
     popd
   '';
 
-  pythonImportsCheck = [ "pymodbus" ];
+  pythonImportsCheck = [
+    "pymodbus"
+  ];
+
+  disabledTests = [
+    # Tests often hang
+    "test_connected"
+  ];
 
   meta = with lib; {
     description = "Python implementation of the Modbus protocol";
diff --git a/pkgs/development/python-modules/pypoint/default.nix b/pkgs/development/python-modules/pypoint/default.nix
index bd4a121d35be..b19554ea48ff 100644
--- a/pkgs/development/python-modules/pypoint/default.nix
+++ b/pkgs/development/python-modules/pypoint/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pypoint";
-  version = "2.3.0";
+  version = "2.3.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "fredrike";
     repo = "pypoint";
     rev = "v${version}";
-    hash = "sha256-609Zme9IUl8eHNxzrYsRAg7bgZho/OklGM7oI+imyZQ=";
+    hash = "sha256-fO0un6YIK3jutzUxbu9mSqPZHfLa3pMtfxOy1iV3Qio=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-homewizard-energy/default.nix b/pkgs/development/python-modules/python-homewizard-energy/default.nix
index c6b5f1ec4539..bffdc7dd2756 100644
--- a/pkgs/development/python-modules/python-homewizard-energy/default.nix
+++ b/pkgs/development/python-modules/python-homewizard-energy/default.nix
@@ -4,7 +4,6 @@
 , awesomeversion
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , protobuf
 , pytest-asyncio
@@ -14,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-homewizard-energy";
-  version = "2.0.2";
+  version = "2.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,18 +22,9 @@ buildPythonPackage rec {
     owner = "DCSBL";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XTSnIL/hBL1Rsyv/tBce/WCvA3n7mZern0v3i6gTOeA=";
+    hash = "sha256-+RuUNH95Txs6JeObYqg2CQl7qxF4YLVQvBDfzj5L9Bk=";
   };
 
-  patches = [
-    # https://github.com/DCSBL/python-homewizard-energy/pull/235
-    (fetchpatch {
-      name = "remove-setuptools-dependency.patch";
-      url = "https://github.com/DCSBL/python-homewizard-energy/commit/b006b0bc1f3d0b4a7569654a1afa90dd4cffaf18.patch";
-      hash = "sha256-WQeepxiYnBfFcQAmrc3pavBz5j1Qo0HmUcOxsK/pr50=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
index d45febae139c..51385c464342 100644
--- a/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
+++ b/pkgs/development/python-modules/python-lsp-jsonrpc/default.nix
@@ -2,20 +2,38 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
 , ujson
 }:
 
 buildPythonPackage rec {
   pname = "python-lsp-jsonrpc";
-  version = "1.0.0";
+  version = "1.1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0h4bs8s4axcm0p02v59amz9sq3nr4zhzdgwq7iaw6awl27v1hd0i";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-XTvnDTaP5oweGSq1VItq+SEv7S/LrQq4YP1XQc3bxbk=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--cov-report html --cov-report term --junitxml=pytest.xml --cov pylsp_jsonrpc --cov test" ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     ujson
   ];
@@ -24,17 +42,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov-report html --cov-report term --junitxml=pytest.xml" "" \
-      --replace "--cov pylsp_jsonrpc --cov test" ""
-  '';
-
-  pythonImportsCheck = [ "pylsp_jsonrpc" ];
+  pythonImportsCheck = [
+    "pylsp_jsonrpc"
+  ];
 
   meta = with lib; {
-    description = "Python server implementation of the JSON RPC 2.0 protocol.";
+    description = "Python server implementation of the JSON RPC 2.0 protocol";
     homepage = "https://github.com/python-lsp/python-lsp-jsonrpc";
+    changelog = "https://github.com/python-lsp/python-lsp-jsonrpc/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 2dca97b7f858..a74ebb5b5bb9 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -4,9 +4,9 @@
 , buildPythonPackage
 , docstring-to-markdown
 , fetchFromGitHub
-, fetchpatch
 , flake8
 , flaky
+, importlib-metadata
 , jedi
 , matplotlib
 , mccabe
@@ -19,9 +19,9 @@
 , pylint
 , pyqt5
 , pytestCheckHook
-, pythonRelaxDepsHook
 , python-lsp-jsonrpc
 , pythonOlder
+, pythonRelaxDepsHook
 , rope
 , setuptools
 , setuptools-scm
@@ -35,27 +35,18 @@
 
 buildPythonPackage rec {
   pname = "python-lsp-server";
-  version = "1.7.4";
+  version = "1.8.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "python-lsp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-plciPUROFileVULGBZpwUTkW2NZVHy4Nuf4+fSjd8nM=";
+    hash = "sha256-hLgMGZumuNY70/qyD9t5pMpYI/g70sqFIt1LEfIEALY=";
   };
 
-  patches = [
-    # https://github.com/python-lsp/python-lsp-server/pull/416
-    (fetchpatch {
-      name = "bump-jedi-upper-pin-to-0.20.patch";
-      url = "https://github.com/python-lsp/python-lsp-server/commit/f33a93afc8c3a0f16751f9e1f6601a37967fd7df.patch";
-      hash = "sha256-lBpzXxjlQp2ig0z2DRJw+jQZ5eRLIOJYjGrzfgvknDA=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace "--cov-report html --cov-report term --junitxml=pytest.xml" "" \
@@ -86,6 +77,8 @@ buildPythonPackage rec {
     python-lsp-jsonrpc
     setuptools # `pkg_resources`imported in pylsp/config/config.py
     ujson
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
   ];
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/python-ndn/default.nix b/pkgs/development/python-modules/python-ndn/default.nix
index 60cde865ae00..4f7307f155e0 100644
--- a/pkgs/development/python-modules/python-ndn/default.nix
+++ b/pkgs/development/python-modules/python-ndn/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportChecks = [ "ndn" ];
+  pythonImportsCheck = [ "ndn" ];
 
   meta = with lib; {
     description = "An NDN client library with AsyncIO support";
diff --git a/pkgs/development/python-modules/python-socketio/default.nix b/pkgs/development/python-modules/python-socketio/default.nix
index 4e4150763269..f046f7c81189 100644
--- a/pkgs/development/python-modules/python-socketio/default.nix
+++ b/pkgs/development/python-modules/python-socketio/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "python-socketio";
-  version = "5.8.0";
+  version = "5.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-socketio";
     rev = "v${version}";
-    hash = "sha256-3Do3Ql48cmhvrFe14ZYvWH0xi3T8hJ2LP0FyyWin580=";
+    hash = "sha256-1lyTZwkRpGRbeBqt6Thv5o+bUzkD1sC3T9T1GbWMEkI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/python-telegram-bot/default.nix b/pkgs/development/python-modules/python-telegram-bot/default.nix
index 605d8157051c..93969551842b 100644
--- a/pkgs/development/python-modules/python-telegram-bot/default.nix
+++ b/pkgs/development/python-modules/python-telegram-bot/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "python-telegram-bot";
-  version = "20.4";
+  version = "20.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-owbJJZjBkMjsgfBLRl+rnePrIvQ0sUZs7rP9ie912pw=";
+    hash = "sha256-/AdGpOl87EeVDCAZLjtan7ttE2vUL0gi1qeM18ilYEQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-yate/default.nix b/pkgs/development/python-modules/python-yate/default.nix
new file mode 100644
index 000000000000..a35773f298de
--- /dev/null
+++ b/pkgs/development/python-modules/python-yate/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, aiohttp
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "python-yate";
+  version = "0.4.1";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "eventphone";
+    repo = "python-yate";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AdnlNsEOFuzuGTBmfV9zKyv2iFHEJ4eLMrC6SHHf7m0=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "yate"
+  ];
+
+  meta = with lib; {
+    description = "Python library for the yate telephony engine";
+    homepage = "https://github.com/eventphone/python-yate";
+    changelog = "https://github.com/eventphone/python-yate/releases/tag/v${version}";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ clerie ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytrafikverket/default.nix b/pkgs/development/python-modules/pytrafikverket/default.nix
index d1105af452c1..3cb161c281c4 100644
--- a/pkgs/development/python-modules/pytrafikverket/default.nix
+++ b/pkgs/development/python-modules/pytrafikverket/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pytrafikverket";
-  version = "0.3.5";
+  version = "0.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dBD8CpEiCDhuabUEPzbvhl3WnEcJU9T910VCAI2jDrA=";
+    hash = "sha256-HHvjwkJ+7QMu1lMe6ouV2j3Y67Vv9aoVaJaKDLXbJpU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pywaze/default.nix b/pkgs/development/python-modules/pywaze/default.nix
index fbaa0e94ea87..02ae6ac07abc 100644
--- a/pkgs/development/python-modules/pywaze/default.nix
+++ b/pkgs/development/python-modules/pywaze/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pywaze";
-  version = "0.3.0";
+  version = "0.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "eifinger";
     repo = "pywaze";
     rev = "refs/tags/v${version}";
-    hash = "sha256-z/6eSgERHKV/5vjbRWcyrxAMNDIHvM3GUoo3xf+AhNY=";
+    hash = "sha256-m3erAODTBR0LrZIKzP2Kw5dSaFKP7ehnrO9z5ILvUw8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyweatherflowrest/default.nix b/pkgs/development/python-modules/pyweatherflowrest/default.nix
index 694f37de3974..2d04fe3feb21 100644
--- a/pkgs/development/python-modules/pyweatherflowrest/default.nix
+++ b/pkgs/development/python-modules/pyweatherflowrest/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyweatherflowrest";
-  version = "1.0.10";
+  version = "1.0.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-7eNhvpaikzdQBrzjXw67JGqoynvfmz4poruharTkuG0=";
+    hash = "sha256-l1V3HgzqnnoY6sWHwfgBtcIR782RwKhekY2qOLrUMNY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/speg/default.nix b/pkgs/development/python-modules/speg/default.nix
index 83bdc1e5b046..5c969f55b168 100644
--- a/pkgs/development/python-modules/speg/default.nix
+++ b/pkgs/development/python-modules/speg/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     extension = "zip";
   };
 
-  pythonImportChecks = [ "speg" ];
+  pythonImportsCheck = [ "speg" ];
 
   # checks fail for seemingly spurious reasons
   doCheck = false;
diff --git a/pkgs/development/python-modules/sseclient-py/default.nix b/pkgs/development/python-modules/sseclient-py/default.nix
index 54dfdd9d9498..5e9fcf4c61e9 100644
--- a/pkgs/development/python-modules/sseclient-py/default.nix
+++ b/pkgs/development/python-modules/sseclient-py/default.nix
@@ -1,24 +1,40 @@
-{ buildPythonPackage, fetchFromGitHub, lib, python }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "sseclient-py";
-  version = "1.7.2";
+  version = "1.8.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "mpetazzoni";
     repo = "sseclient";
     rev = "sseclient-py-${version}";
-    sha256 = "096spyv50jir81xiwkg9l88ycp1897d3443r6gi1by8nkp4chvix";
+    hash = "sha256-rNiJqR7/e+Rhi6kVBY8gZJZczqSUsyszotXkb4OKfWk=";
   };
 
-  # based on tox.ini
-  checkPhase = ''
-    ${python.interpreter} tests/unittests.py
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sseclient"
+  ];
+
+  pytestFlagsArray = [
+    "tests/unittests.py"
+  ];
 
   meta = with lib; {
     description = "Pure-Python Server Side Events (SSE) client";
     homepage = "https://github.com/mpetazzoni/sseclient";
+    changelog = "https://github.com/mpetazzoni/sseclient/releases/tag/sseclient-py-${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ jamiemagee ];
   };
diff --git a/pkgs/development/python-modules/tensorflow-datasets/default.nix b/pkgs/development/python-modules/tensorflow-datasets/default.nix
index 1d60c09c6a82..3fd7a441106d 100644
--- a/pkgs/development/python-modules/tensorflow-datasets/default.nix
+++ b/pkgs/development/python-modules/tensorflow-datasets/default.nix
@@ -48,13 +48,13 @@
 
 buildPythonPackage rec {
   pname = "tensorflow-datasets";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchFromGitHub {
     owner = "tensorflow";
     repo = "datasets";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FKquhuk5hVBH9Im2RrIwgmosgqkoJHj0ESR2BmAOlbI=";
+    hash = "sha256-ZXCcXChrWqs0FAK5Fe8cD+MuJpWa9Dwo/ny5fOX2lKU=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/truststore/default.nix b/pkgs/development/python-modules/truststore/default.nix
index d5b5bbb0b70c..961799efeb72 100644
--- a/pkgs/development/python-modules/truststore/default.nix
+++ b/pkgs/development/python-modules/truststore/default.nix
@@ -1,24 +1,27 @@
 { lib
+, aiohttp
 , buildPythonPackage
 , fetchFromGitHub
 , flit-core
-, aiohttp
 , httpx
 , pyopenssl
+, pythonOlder
 , requests
 , trustme
 }:
 
 buildPythonPackage rec {
   pname = "truststore";
-  version = "0.7.0";
+  version = "0.8.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.10";
+
   src = fetchFromGitHub {
     owner = "sethmlarson";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Q3HSHcqoG2DEXujL05lj3GLNu4jJ61i7VFxMou8c0cE=";
+    hash = "sha256-K11nHzpckNR8pqmgLOo/yCJ2cNQnqPHgjMDPQkpeRkQ=";
   };
 
   nativeBuildInputs = [
@@ -36,10 +39,14 @@ buildPythonPackage rec {
   # tests requires networking
   doCheck = false;
 
+  pythonImportsCheck = [
+    "truststore"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/sethmlarson/truststore";
     description = "Verify certificates using native system trust stores";
-    changelog = "https://github.com/sethmlarson/truststore/releases/tag/v${version}";
+    changelog = "https://github.com/sethmlarson/truststore/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ anthonyroussel ];
   };
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index ef2678e88b31..6d2cfc72c43b 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "8.7.0";
+  version = "8.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-wzsAHW0OlorLVI6nnDjv8WP1dpzyrmtE4OfwzFnZOH4=";
+    hash = "sha256-fWAVTaie+6lz5cX7hg0s22kHXelIfhh5FNTfxxbUEPw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index a3b175041070..1209df8042b7 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -79,9 +79,9 @@ buildPythonPackage rec {
 
   FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
 
-  # Fontconfig error: Cannot load default config file: No such file: (null)
+  # Set env variable explicitly for Darwin, but allow overriding when invoking directly
   makeWrapperArgs = [
-    "--set FONTCONFIG_FILE ${FONTCONFIG_FILE}"
+    "--set-default FONTCONFIG_FILE ${FONTCONFIG_FILE}"
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index 727306bea22d..39829fc3acd0 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.2.3";
+  version = "2.3.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z8pPN9cO/8jv66yrG2EKRDXNjKPbYarOOB5t9ObMzek=";
+    hash = "sha256-QL8S5fDNi6msyaV14E6tgN0C/nvXqV0+Mx+4AY0um4o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ypy-websocket/default.nix b/pkgs/development/python-modules/ypy-websocket/default.nix
index fb7a18c325bc..70b9d9bfb0bf 100644
--- a/pkgs/development/python-modules/ypy-websocket/default.nix
+++ b/pkgs/development/python-modules/ypy-websocket/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "ypy-websocket";
-  version = "0.12.2";
+  version = "0.12.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "y-crdt";
     repo = "ypy-websocket";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3ANuIwRxUoFo5SSdTvBhTHExrYR7timu7XkE0t+UyWk=";
+    hash = "sha256-gBLRjqsI2xx2z8qfaix4Gsm1rlNcjZ5g1PNVW7N4Q5k=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/zeroconf/default.nix b/pkgs/development/python-modules/zeroconf/default.nix
index a0d3cd2517b0..be93601255fd 100644
--- a/pkgs/development/python-modules/zeroconf/default.nix
+++ b/pkgs/development/python-modules/zeroconf/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.102.0";
+  version = "0.103.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "jstasiak";
     repo = "python-zeroconf";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z4RswQDA05wXXyg8CeIiuh9I1EXTyXh6Z88r7soGFTo=";
+    hash = "sha256-15nOSQOM1c9zISsTwY2pdRLIp2/sLnBmb/5LMoWHyfo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/bear/default.nix b/pkgs/development/tools/build-managers/bear/default.nix
index c82d322cf58e..880184880db1 100644
--- a/pkgs/development/tools/build-managers/bear/default.nix
+++ b/pkgs/development/tools/build-managers/bear/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bear";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "rizsotto";
     repo = pname;
     rev = version;
-    sha256 = "sha256-x46BS+By5Zj5xeYRD45eXRDCAOqwpkkivVyJPnhkAMc=";
+    hash = "sha256-1nZPzgLWcmaRkOUXdm16IW2Nw/p1w8GBGEfZX/v+En0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -44,15 +44,10 @@ stdenv.mkDerivation rec {
   patches = [
     # Default libexec would be set to /nix/store/*-bear//nix/store/*-bear/libexec/...
     ./no-double-relative.patch
-
-    # Fix compatiblity with fmt 10.0. Remove with the next release
-    (fetchpatch {
-      url = "https://github.com/rizsotto/Bear/commit/46a032fa0fc8131779ece13f26735ec84be891e8.patch";
-      hash = "sha256-zYKwQ5PLSTJ1hROGnTfP8xPoM0cBw6abAZLx6GxmdfI=";
-    })
   ];
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "Tool that generates a compilation database for clang tooling";
     longDescription = ''
       Note: the bear command is very useful to generate compilation commands
diff --git a/pkgs/development/tools/build-managers/corrosion/default.nix b/pkgs/development/tools/build-managers/corrosion/default.nix
index b2b2e45497d5..97b967d4a2b3 100644
--- a/pkgs/development/tools/build-managers/corrosion/default.nix
+++ b/pkgs/development/tools/build-managers/corrosion/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corrosion";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "corrosion-rs";
     repo = "corrosion";
     rev = "v${version}";
-    hash = "sha256-/PSOAEtJtn9OykPiN3RhRv59wgQNJ0HoMyYS5RCdSCI=";
+    hash = "sha256-Bvx4Jvd/l1EHB3eoBEizuT4Lou4Ev+CPA7D7iWIe+No=";
   };
 
   cargoRoot = "generator";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     inherit src;
     sourceRoot = "${src.name}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-lJaK+0NmlnTsV3h5Pqpqd8uA3g8PGERWfq2aR7FtYrc=";
+    hash = "sha256-0n45edWVSaYQS+S0H4p55d+ZgD6liHn6iBd3qCtjAh8=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
diff --git a/pkgs/development/tools/electron-fiddle/default.nix b/pkgs/development/tools/electron-fiddle/default.nix
index eb4874750fae..5fe0a88f2528 100644
--- a/pkgs/development/tools/electron-fiddle/default.nix
+++ b/pkgs/development/tools/electron-fiddle/default.nix
@@ -61,7 +61,7 @@ let
       patchShebangs node_modules
 
       mkdir -p ~/.cache/electron/${electronDummyHash}
-      cp -ra '${electron}/lib/electron' "$TMPDIR/electron"
+      cp -ra '${electron}/libexec/electron' "$TMPDIR/electron"
       chmod -R u+w "$TMPDIR/electron"
       (cd "$TMPDIR/electron" && zip -0Xr ~/.cache/electron/${electronDummyHash}/${electronDummyFilename} .)
 
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index 34b7f239ecfe..615ec9243bb2 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -82,25 +82,22 @@ let
       wrapGAppsHook
     ];
 
-    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
-
     dontUnpack = true;
     dontBuild = true;
 
     installPhase = ''
-      mkdir -p $out/lib/electron $out/bin
-      unzip -d $out/lib/electron $src
-      ln -s $out/lib/electron/electron $out/bin
+      mkdir -p $out/libexec/electron $out/bin
+      unzip -d $out/libexec/electron $src
+      ln -s $out/libexec/electron/electron $out/bin
+      chmod u-x $out/libexec/electron/*.so*
     '';
 
     postFixup = ''
       patchelf \
         --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:${electronLibPath}:$out/lib/electron" \
-        $out/lib/electron/electron \
-        ${lib.optionalString (lib.versionAtLeast version "15.0.0") "$out/lib/electron/chrome_crashpad_handler" }
-
-      wrapProgram $out/lib/electron/electron "''${gappsWrapperArgs[@]}"
+        --set-rpath "${atomEnv.libPath}:${electronLibPath}:$out/libexec/electron" \
+        $out/libexec/electron/.electron-wrapped \
+        ${lib.optionalString (lib.versionAtLeast version "15.0.0") "$out/libexec/electron/.chrome_crashpad_handler-wrapped" }
     '';
   };
 
diff --git a/pkgs/development/tools/fsautocomplete/default.nix b/pkgs/development/tools/fsautocomplete/default.nix
index aaa117622705..18075335664a 100644
--- a/pkgs/development/tools/fsautocomplete/default.nix
+++ b/pkgs/development/tools/fsautocomplete/default.nix
@@ -5,13 +5,13 @@ let
 in
 buildDotnetModule rec {
   pname = "fsautocomplete";
-  version = "0.62.0";
+  version = "0.63.0";
 
   src = fetchFromGitHub {
     owner = "fsharp";
     repo = "FsAutoComplete";
     rev = "v${version}";
-    sha256 = "sha256-pU/XGZZScbS2OiExLry4e9Oto9LrYr7j99y9+hRc+BU=";
+    sha256 = "sha256-Or7KjJVi0N8edO+Q8bBCNrNAE974ClJfXT7Co8YXWjI=";
   };
 
   nugetDeps = ./deps.nix;
diff --git a/pkgs/development/tools/fsautocomplete/deps.nix b/pkgs/development/tools/fsautocomplete/deps.nix
index 4fed6a4f6d3e..3a5d1da615cd 100644
--- a/pkgs/development/tools/fsautocomplete/deps.nix
+++ b/pkgs/development/tools/fsautocomplete/deps.nix
@@ -41,6 +41,8 @@
   (fetchNuGet { pname = "Fake.Tools.Git"; version = "5.23.1"; sha256 = "0cg1sbp7zl1d18cjhbs94ix8580hr6gyaxjw17q246lbaj9bfg8l"; })
   (fetchNuGet { pname = "fantomas"; version = "6.1.0"; sha256 = "0qk983ybs66infm6q60qsn6sl9i17i6rjavsygcld6w3vfzza9kx"; })
   (fetchNuGet { pname = "Fantomas.Client"; version = "0.9.0"; sha256 = "1zixwk61fyk7y9q6f8266kwxi6byr8fmyp1lf57qhbbvhq2waj9d"; })
+  (fetchNuGet { pname = "Fantomas.Core"; version = "6.2.0"; sha256 = "07yl2hr06zk1nl66scm24di3nf1zbrnd6329prwirnv370rz4q92"; })
+  (fetchNuGet { pname = "Fantomas.FCS"; version = "6.2.0"; sha256 = "1hhsa7hbxsm2d8ap4sqzwlzjmf4wsgg74i731rprr0nshjvd8ic7"; })
   (fetchNuGet { pname = "FParsec"; version = "1.1.1"; sha256 = "01s3zrxl9kfx0264wy0m555pfx0s0z165n4fvpgx63jlqwbd8m04"; })
   (fetchNuGet { pname = "FSharp.Analyzers.SDK"; version = "0.11.0"; sha256 = "0djgbxnygmpdkrw923z2vgirs5kamrvf94ls7pvnk43c52xlb0pf"; })
   (fetchNuGet { pname = "FSharp.Compiler.Service"; version = "43.7.400"; sha256 = "1sdc63vyplw02s5wzrly1kdsmhb144arj57q22yggigmsrhzqlag"; })
@@ -117,6 +119,8 @@
   (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.4.0"; sha256 = "1smx30nq22plrn2mw4wb5vfgxk6hyx12b60c4wabmpnr81lq3nzv"; })
   (fetchNuGet { pname = "Microsoft.NET.StringTools"; version = "17.6.3"; sha256 = "0g5jdg0jp844a2ygwlm04igsxkrihqcq2rpmfx722nrv3vrk0r0z"; })
   (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.4.1"; sha256 = "02p1j9fncd4fb2hyp51kw49d0dz30vvazhzk24c9f5ccc00ijpra"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "7.0.4"; sha256 = "0afmivk3m0hmwsiqnl87frzi7g57aiv5fwnjds0icl66djpb6zsm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "5.0.0"; sha256 = "0z3qyv7qal5irvabc8lmkh58zsl42mrzd1i0sssvzhv4q4kl3cg6"; })
   (fetchNuGet { pname = "Microsoft.NETFramework.ReferenceAssemblies"; version = "1.0.3"; sha256 = "0hc4d4d4358g5192mf8faijwk0bpf9pjwcfd3h85sr67j0zhj6hl"; })
   (fetchNuGet { pname = "Microsoft.NETFramework.ReferenceAssemblies.net461"; version = "1.0.3"; sha256 = "1jcc552rwpaybd2ql0b31063ayj70sd3k6qqpf850xmqbyg2hlmx"; })
   (fetchNuGet { pname = "Microsoft.SourceLink.AzureRepos.Git"; version = "1.1.1"; sha256 = "059c8i2vybprn63sw2jr7xma4yyl2syx6hzygfdpr0zd5jlgy9rz"; })
@@ -186,6 +190,7 @@
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "7.0.0"; sha256 = "1wilasn2qmj870h2bhw348lspamm7pbinpb4m89icg113510l00v"; })
   (fetchNuGet { pname = "System.Reflection.MetadataLoadContext"; version = "6.0.0"; sha256 = "1ijfiqpi3flp5g9amridhjjmzz6md1c6pnxx5h7pdbiqqx9rwrpk"; })
   (fetchNuGet { pname = "System.Resources.Extensions"; version = "6.0.0"; sha256 = "1h73gps9ffw77vys4zwgm78fgackqw6a7rjrg75mmx79vdw1shgw"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.1"; sha256 = "03ch4d2acf6q037a4njxpll2kkx3dwzlg07yxr4z5m6j1kqgmm27"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
   (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "5.0.0"; sha256 = "06hkx2za8jifpslkh491dfwzm5dxrsyxzj5lsc0achb6yzg4zqlw"; })
diff --git a/pkgs/development/tools/gci/default.nix b/pkgs/development/tools/gci/default.nix
index 5ce37c9773c5..d89f648ac941 100644
--- a/pkgs/development/tools/gci/default.nix
+++ b/pkgs/development/tools/gci/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "gci";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "daixiang0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EBklnsZR8VwM89BztligZBDapmgyKuI9Ns8EFFo3ai8=";
+    sha256 = "sha256-qNkSAbVhX4P+DqCtxXSnxYjZwq/nMYsDpEif+q1oTIA=";
   };
 
   vendorHash = "sha256-g7htGfU6C2rzfu8hAn6SGr0ZRwB8ZzSf9CgHYmdupE8=";
diff --git a/pkgs/development/tools/language-servers/vhdl-ls/Cargo.lock b/pkgs/development/tools/language-servers/vhdl-ls/Cargo.lock
deleted file mode 100644
index a73f1544e2ca..000000000000
--- a/pkgs/development/tools/language-servers/vhdl-ls/Cargo.lock
+++ /dev/null
@@ -1,1063 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "aho-corasick"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "anstream"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is-terminal",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a30da5c5f2d5e72842e00bcb57657162cdabef0931f40e2deb9b4140440cecd"
-
-[[package]]
-name = "anstyle-parse"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
-dependencies = [
- "anstyle",
- "windows-sys",
-]
-
-[[package]]
-name = "assert_matches"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
-
-[[package]]
-name = "autocfg"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
-
-[[package]]
-name = "cc"
-version = "1.0.79"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "clap"
-version = "4.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384e169cc618c613d5e3ca6404dda77a8685a63e08660dcc64abaf7da7cb0c7a"
-dependencies = [
- "clap_builder",
- "clap_derive",
- "once_cell",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef137bbe35aab78bdb468ccfba75a5f4d8321ae011d34063770780545176af2d"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8cd2b2a819ad6eec39e8f1d6b53001af1e5469f8c177579cdaeb313115b825f"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.22",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
-dependencies = [
- "cfg-if",
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
-dependencies = [
- "autocfg",
- "cfg-if",
- "crossbeam-utils",
- "memoffset",
- "scopeguard",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "ctor"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d2301688392eb071b0bf1a37be05c469d3cc4dbbd95df672fe28ab021e6a096"
-dependencies = [
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "diff"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
-
-[[package]]
-name = "dirs"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059"
-dependencies = [
- "dirs-sys",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users",
- "winapi",
-]
-
-[[package]]
-name = "dunce"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
-
-[[package]]
-name = "either"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
-
-[[package]]
-name = "env_logger"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85cdab6a89accf66733ad5a1693a4dcced6aeff64602b634530dd73c1f3ee9f0"
-dependencies = [
- "humantime",
- "is-terminal",
- "log",
- "regex",
- "termcolor",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88bffebc5d80432c9b140ee17875ff173a8ab62faad5b257da912bd2f6c1c0a1"
-
-[[package]]
-name = "errno"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
-dependencies = [
- "cc",
- "libc",
-]
-
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "form_urlencoded"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
-dependencies = [
- "percent-encoding",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi",
-]
-
-[[package]]
-name = "glob"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
-
-[[package]]
-name = "hashbrown"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
-
-[[package]]
-name = "humantime"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
-
-[[package]]
-name = "idna"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
-dependencies = [
- "unicode-bidi",
- "unicode-normalization",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24fddda5af7e54bf7da53067d6e802dbcc381d0a8eef629df528e3ebf68755cb"
-dependencies = [
- "hermit-abi",
- "rustix 0.38.1",
- "windows-sys",
-]
-
-[[package]]
-name = "itertools"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
-
-[[package]]
-name = "libc"
-version = "0.2.147"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
-
-[[package]]
-name = "lock_api"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b06a4cde4c0f271a446782e3eff8de789548ce57dbc8eca9292c27f4a42004b4"
-
-[[package]]
-name = "lsp-server"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3711e4d6f491dc9edc0f1df80e204f38206775ac92c1241e89b79229a850bc00"
-dependencies = [
- "crossbeam-channel",
- "log",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "lsp-types"
-version = "0.94.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b63735a13a1f9cd4f4835223d828ed9c2e35c8c5e61837774399f558b6a1237"
-dependencies = [
- "bitflags 1.3.2",
- "serde",
- "serde_json",
- "serde_repr",
- "url",
-]
-
-[[package]]
-name = "memchr"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
-
-[[package]]
-name = "output_vt100"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "628223faebab4e3e40667ee0b2336d34a5b960ff60ea743ddfdbcf7770bcfb66"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "pad"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ad9b889f1b12e0b9ee24db044b5129150d5eada288edc800f789928dc8c0e3"
-dependencies = [
- "unicode-width",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall 0.3.5",
- "smallvec",
- "windows-targets",
-]
-
-[[package]]
-name = "percent-encoding"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
-
-[[package]]
-name = "pinned_vec"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "268ad82d92622fb0a049ff14b01089b0f1bcd5c507fab44724394d328417348a"
-
-[[package]]
-name = "pretty_assertions"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a25e9bcb20aa780fd0bb16b72403a9064d6b3f22f026946029acb941a50af755"
-dependencies = [
- "ctor",
- "diff",
- "output_vt100",
- "yansi",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.63"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b368fba921b0dce7e60f5e04ec15e565b3303972b42bcfde1d0713b881959eb"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "573015e8ab27661678357f27dc26460738fd2b6c86e46f386fde94cb5d913105"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rayon"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
-dependencies = [
- "crossbeam-channel",
- "crossbeam-deque",
- "crossbeam-utils",
- "num_cpus",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_users"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
-dependencies = [
- "getrandom",
- "redox_syscall 0.2.16",
- "thiserror",
-]
-
-[[package]]
-name = "regex"
-version = "1.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0ab3ca65655bb1e41f2a8c8cd662eb4fb035e67c3f78da1d61dffe89d07300f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "436b050e76ed2903236f032a59761c1eb99e1b0aead2c257922771dab1fc8c78"
-
-[[package]]
-name = "rustix"
-version = "0.37.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f25693a73057a1b4cb56179dd3c7ea21a7c6c5ee7d85781f5749b46f34b79c"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.3.8",
- "windows-sys",
-]
-
-[[package]]
-name = "rustix"
-version = "0.38.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbc6396159432b5c8490d4e301d8c705f61860b8b6c863bf79942ce5401968f3"
-dependencies = [
- "bitflags 2.3.3",
- "errno",
- "libc",
- "linux-raw-sys 0.4.3",
- "windows-sys",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "serde"
-version = "1.0.156"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "314b5b092c0ade17c00142951e50ced110ec27cea304b1037c6969246c2469a4"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.156"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7e29c4601e36bcec74a223228dce795f4cd3616341a4af93520ca1a837c087d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.99"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46266871c240a00b8f503b877622fe33430b3c7d963bdc0f2adc511e54a1eae3"
-dependencies = [
- "itoa",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "serde_repr"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.22",
-]
-
-[[package]]
-name = "serde_spanned"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96426c9936fd7a0124915f9185ea1d20aa9445cc9821142f0a73bc9207a2e186"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
-
-[[package]]
-name = "strsim"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2efbeae7acf4eabd6bcdcbd11c92f45231ddda7539edc7806bd1a04a03b24616"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31c0432476357e58790aaa47a8efb0c5138f137343f3b5f23bd36a27e3b0a6d6"
-dependencies = [
- "autocfg",
- "cfg-if",
- "fastrand",
- "redox_syscall 0.3.5",
- "rustix 0.37.21",
- "windows-sys",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
-dependencies = [
- "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.22",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "toml"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebafdf5ad1220cb59e7d17cf4d2c72015297b75b19a10472f99b89225089240"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime",
- "toml_edit",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.19.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "266f016b7f039eec8a1a80dfe6156b633d208b9fccca5e4db1d6775b0c4e34a7"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
-]
-
-[[package]]
-name = "unicode-bidi"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15811caf2415fb889178633e7724bad2509101cde276048e013b9def5e51fa0"
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-width"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
-
-[[package]]
-name = "url"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
-[[package]]
-name = "utf8parse"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
-
-[[package]]
-name = "vhdl_lang"
-version = "0.65.0"
-dependencies = [
- "assert_matches",
- "clap",
- "dirs",
- "dunce",
- "fnv",
- "glob",
- "itertools",
- "pad",
- "parking_lot",
- "pinned_vec",
- "pretty_assertions",
- "rayon",
- "tempfile",
- "toml",
-]
-
-[[package]]
-name = "vhdl_ls"
-version = "0.65.0"
-dependencies = [
- "clap",
- "env_logger",
- "fnv",
- "log",
- "lsp-server",
- "lsp-types",
- "pretty_assertions",
- "serde",
- "serde_json",
- "tempfile",
- "vhdl_lang",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
-dependencies = [
- "winapi",
-]
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
-
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d4b17490f70499f20b9e791dcf6a299785ce8af4d709018206dc5b4953e95f"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
-
-[[package]]
-name = "winnow"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca0ace3845f0d96209f0375e6d367e3eb87eb65d27d445bdc9f1843a26f39448"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "yansi"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
diff --git a/pkgs/development/tools/language-servers/vhdl-ls/default.nix b/pkgs/development/tools/language-servers/vhdl-ls/default.nix
index be42edff8eed..3499d54ce068 100644
--- a/pkgs/development/tools/language-servers/vhdl-ls/default.nix
+++ b/pkgs/development/tools/language-servers/vhdl-ls/default.nix
@@ -5,25 +5,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "vhdl-ls";
-  version = "0.65.0";
+  version = "0.66.0";
 
   src = fetchFromGitHub {
     owner = "VHDL-LS";
     repo = "rust_hdl";
     rev = "v${version}";
-    hash = "sha256-B+jzTrV5Kk4VOgr+5l0F5+cXzfb0aErKaiH50vIdLq4=";
+    hash = "sha256-tVeGfPm5WdZjARp7n4WD3YQzMUWA3M3TJo2oVivtkiA=";
   };
 
-  # No Cargo.lock upstream, see:
-  # https://github.com/VHDL-LS/rust_hdl/issues/166
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-bXz216QvTpBuUNAi5sF0Lga+1ubjlokqPglUyAVXThg=";
+
   postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  ''
-  # Also make it look up vhdl_libraries in an expected location
-  + ''
     substituteInPlace vhdl_lang/src/config.rs \
       --replace /usr/lib $out/lib
   '';
diff --git a/pkgs/development/tools/misc/rsonpath/default.nix b/pkgs/development/tools/misc/rsonpath/default.nix
index 7a1e9ac6d4e7..b078030d8cec 100644
--- a/pkgs/development/tools/misc/rsonpath/default.nix
+++ b/pkgs/development/tools/misc/rsonpath/default.nix
@@ -1,24 +1,20 @@
 { lib
-, stdenv
 , rustPlatform
 , fetchFromGitHub
-, withSimd ? stdenv.isx86_64
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rsonpath";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "v0ldek";
     repo = "rsonpath";
     rev = "v${version}";
-    hash = "sha256-VzHp5xMzAzo8ZCQyFCb1Igb0deJuZX+PIfs/oIy/zR0=";
+    hash = "sha256-WrapSvWoaBVxlpCxau70Et5K9tRs84xsXBDWsuoFI+E=";
   };
 
-  cargoHash = "sha256-bnG95BgK41YJABqEGAbxg+gHoOksWc9nTChK7aCFK2E=";
-
-  buildNoDefaultFeatures = !withSimd;
+  cargoHash = "sha256-fGu6eypizOGHCiyAeH7nCLHyfVLMBPNU1xmqfVGhSzw=";
 
   cargoBuildFlags = [ "-p=rsonpath" ];
   cargoTestFlags = cargoBuildFlags;
diff --git a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
index 3adab620534b..d24ab86538af 100644
--- a/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
+++ b/pkgs/development/tools/protoc-gen-go-vtproto/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "protoc-gen-go-vtproto";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "vtprotobuf";
     rev = "v${version}";
-    sha256 = "sha256-WtiXoQWjjFf+TP2zpAXNH05XdcrLSpw3S0TG4lkzp2E=";
+    sha256 = "sha256-2DpL8CYl0MWpr7TBJPwDlgKvOoa5RrVwMjOxrEP5Wio=";
   };
 
   vendorHash = "sha256-JpSVO8h7+StLG9/dJQkmrIlh9zIHABoqP1hq+X5ajVs=";
diff --git a/pkgs/development/tools/redisinsight/default.nix b/pkgs/development/tools/redisinsight/default.nix
index bb96df683e27..5c4609e248d8 100644
--- a/pkgs/development/tools/redisinsight/default.nix
+++ b/pkgs/development/tools/redisinsight/default.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     yarn --offline electron-builder \
       --dir ${if stdenv.isDarwin then "--macos" else "--linux"} ${if stdenv.hostPlatform.isAarch64 then "--arm64" else "--x64"} \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
diff --git a/pkgs/development/tools/rust/cargo-risczero/default.nix b/pkgs/development/tools/rust/cargo-risczero/default.nix
index 2f50f62aab90..1bb68d7bbd98 100644
--- a/pkgs/development/tools/rust/cargo-risczero/default.nix
+++ b/pkgs/development/tools/rust/cargo-risczero/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-risczero";
-  version = "0.14.0";
+  version = "0.17.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-uZz0jJ3klaOrqzJ0BUVDHxl7lv6vt0GT6RgQuJeyeyk=";
+    hash = "sha256-UXCZ4l45zcyn2AnfDW6dNdEnXCWL2waNwDTbermgS6M=";
   };
 
-  cargoSha256 = "sha256-t++3+Ijn1ykjMcMsdoe/1xfaji+DQvhyiFe6M/Bpbt0=";
+  cargoHash = "sha256-KkV+ZQAPegbeZKj3ixDSFQEyKwkKeMYceSc27xGtQms=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 9da32364d137..cc625347de9d 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/3ThQtAQ0pWEIK4cgqYHqoSXtSJB581NLlsH21UNb50=";
+    hash = "sha256-t71h+s97Ip3Gqs7oCzF8GWpTX0p0ltPt7JT61Gk8xF0=";
   };
 
-  cargoHash = "sha256-KUjkiS8TyaKdf1qRfgp2/JMwFGLAFfeTNcGIq+Z6oEU=";
+  cargoHash = "sha256-oJ+zAtTwFSSzwq1gvkRloBj8g30G8Eq7dG2RoaX39lA=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index bf201b5eb5b8..1afb444c323d 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-R/GFAbaR/f3kO1n4jQyCPOkfG9fRubnuQy0VUg0NqKw=";
+    sha256 = "sha256-f4U3vzgvFF1N6X8f8zwtqSaQfiwNX7CecpcJ0GKx2P0=";
   };
 
-  cargoSha256 = "sha256-Ca6HNhdT5/CAI3qyzM7wBuCYYOPOHEyP+QyDia1csUo=";
+  cargoSha256 = "sha256-az5j0qvP3mZXRJZOmslDb40MSMS+iAvXYVNGw8vt7gg=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/development/tools/swc/default.nix b/pkgs/development/tools/swc/default.nix
index b71594de7224..afb4ad5d5899 100644
--- a/pkgs/development/tools/swc/default.nix
+++ b/pkgs/development/tools/swc/default.nix
@@ -5,7 +5,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swc";
-  version = "0.91.68";
+  version = "0.91.69";
 
   env = {
     # swc depends on nightly features
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage rec {
   src = fetchCrate {
     pname = "swc_cli";
     inherit version;
-    sha256 = "sha256-SLVXh+8oBcq/pKHB5mMLPOR4J3Xlns5eNs8mo2qh/30=";
+    sha256 = "sha256-8zbxE1qkEWeSYt2L5PElZeJPRuK4Yiooy8xDmCD/PYw=";
   };
 
-  cargoSha256 = "sha256-nYMy4OtzNymzan/xZ6Ekx9QL+6AOtciI+sLl4f2Owy0=";
+  cargoSha256 = "sha256-kRsRUOvDMRci3bN5NfhiLCWojNkSuLz3K4BfKfGYc7g=";
 
   buildFeatures = [ "swc_core/plugin_transform_host_native" ];
 
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/games/quakespasm/default.nix
index 51d0528ac933..b9541d1b274e 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "quakespasm";
-  version = "0.95.1";
+  version = "0.96.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
-    sha256 = "sha256-hBmEV3s65yQysMiq4zEP4swfCgCCiT5dzZdhg7bSNOI=";
+    sha256 = "sha256-Sa4lLALB3xpMGVjpKnzGl1OBEJcLOHDcFGEFsO0wwOw=";
   };
 
   sourceRoot = "${pname}-${version}/Quake";
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
new file mode 100644
index 000000000000..a73cc1896ecd
--- /dev/null
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -0,0 +1,41 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, hostname
+}:
+
+stdenv.mkDerivation {
+  pname = "fw-ectool";
+  version = "unstable-2022-12-03";
+
+  src = fetchFromGitHub {
+    owner = "DHowett";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    hostname
+  ];
+
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
+
+  installPhase = ''
+    install -D out/util/ectool $out/bin/ectool
+  '';
+
+  meta = with lib; {
+    description = "EC-Tool adjusted for usage with framework embedded controller";
+    homepage = "https://github.com/DHowett/framework-ec";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.mkg20001 ];
+    platforms = platforms.linux;
+    mainProgram = "ectool";
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index f3ffbde6f1d9..ab62028af7bc 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,71 +2,71 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.323-hardened1.patch",
-            "sha256": "0id59byd331mz8ga02gbs3g1q0y4n2wz6mi9s0dmp1yjagjd9m70",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.323-hardened1/linux-hardened-4.14.323-hardened1.patch"
+            "name": "linux-hardened-4.14.325-hardened1.patch",
+            "sha256": "1mc1pyjjksg2f4189wyas55ax8czzhai2i3jc6n7l9jmfwj7xr9q",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.325-hardened1/linux-hardened-4.14.325-hardened1.patch"
         },
-        "sha256": "1g2fh0mn1sv0kq2hh3pynmx2fjai7hdwhf4fnaspl7j5n88902kg",
-        "version": "4.14.323"
+        "sha256": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav",
+        "version": "4.14.325"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.292-hardened1.patch",
-            "sha256": "1na729sricp347jqp3y2j4yxxg84haa62mwmj9zq0pa1k6f037ph",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.292-hardened1/linux-hardened-4.19.292-hardened1.patch"
+            "name": "linux-hardened-4.19.294-hardened1.patch",
+            "sha256": "1s70vz8rai1z440rmwzipwpq7wa7p2bvri43zmkbisrfggm1lz2r",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.294-hardened1/linux-hardened-4.19.294-hardened1.patch"
         },
-        "sha256": "0dr12v4jqmzxcqdghqqjny5zp3g4dx9lxqrl9d4fxz23s79ji5rl",
-        "version": "4.19.292"
+        "sha256": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc",
+        "version": "4.19.294"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.191-hardened1.patch",
-            "sha256": "02949v0qrr4b76g9rl1z8lkdfv3mc1pfb4h14z9bd0dqg5shlz0j",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.191-hardened1/linux-hardened-5.10.191-hardened1.patch"
+            "name": "linux-hardened-5.10.194-hardened1.patch",
+            "sha256": "1ba8ridhjz9y8ap1wgp7z41jmwzx8j0bxkyp1zjfls1z7mqq4vpf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.194-hardened1/linux-hardened-5.10.194-hardened1.patch"
         },
-        "sha256": "1hk2x5dgvfq9v6161v25wz5qpzgyvqbx34xbm7ww8z4ish76cm6b",
-        "version": "5.10.191"
+        "sha256": "15fr7krhpmqz0xqjg78m2xvfllbni3xh8xyhxh9ni31ppd3mw394",
+        "version": "5.10.194"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.127-hardened1.patch",
-            "sha256": "13z0x45jig81f3vhb5w3lvb554b78888grp7w60sqgglx7bckspb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.127-hardened1/linux-hardened-5.15.127-hardened1.patch"
+            "name": "linux-hardened-5.15.130-hardened1.patch",
+            "sha256": "12wm6kyg63rg1lk1w9208vpcm71cjy236rjp9gf8mfx7iraqssl7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.130-hardened1/linux-hardened-5.15.130-hardened1.patch"
         },
-        "sha256": "09lgj9hs1cjxg84hb7avras4rlsx18igr69mx433l9hv6issbl5d",
-        "version": "5.15.127"
+        "sha256": "0qix62jsn3z9yccakac7fvqnip19zi05qn0w5wkgb7rj0x0lwimb",
+        "version": "5.15.130"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.254-hardened1.patch",
-            "sha256": "0yh5kb23lp89qnk90lz73j101bg20npr7clx0y8zmg6dihls764z",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.254-hardened1/linux-hardened-5.4.254-hardened1.patch"
+            "name": "linux-hardened-5.4.256-hardened1.patch",
+            "sha256": "1rsp30g5xry5y95mz0i6walkcxj6abyrsaq3fwhz0ka6nq6g7w82",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.256-hardened1/linux-hardened-5.4.256-hardened1.patch"
         },
-        "sha256": "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i",
-        "version": "5.4.254"
+        "sha256": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967",
+        "version": "5.4.256"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.47-hardened1.patch",
-            "sha256": "0wgsjb05m9f0fgv4vj0m0ll9bx22z894qlpwb45b33mq66fvbgwn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.47-hardened1/linux-hardened-6.1.47-hardened1.patch"
+            "name": "linux-hardened-6.1.51-hardened1.patch",
+            "sha256": "0nbf7j3hwlsvh8f4mmc9w2gqdcj8lyx1hxrz91y2hwlqlqjx7w4p",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.51-hardened1/linux-hardened-6.1.51-hardened1.patch"
         },
-        "sha256": "1azwvlzyp1s2adm17ic0jfmv3ph70wqzycb8s96z9987y1m8pmck",
-        "version": "6.1.47"
+        "sha256": "0fqhmb6v28rssd44z7jw57mwvvskpl4kabjylck0pg54irnl9c2q",
+        "version": "6.1.51"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.12-hardened1.patch",
-            "sha256": "0xkcvyy2ii5wfdw8h21svcsz3s3q0qk4yx7dxzbrisap10d79l51",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.12-hardened1/linux-hardened-6.4.12-hardened1.patch"
+            "name": "linux-hardened-6.4.14-hardened1.patch",
+            "sha256": "1cw0zyjxbfprb2m2kjrpz8s56axbzhnwj8hg9b0486nsqz5s66bs",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.14-hardened1/linux-hardened-6.4.14-hardened1.patch"
         },
-        "sha256": "0x56b4hslm730ghvggz41fjkbzlnxp6k8857dn7iy27yavlipafc",
-        "version": "6.4.12"
+        "sha256": "1rjh0jrn5qvxwzmyg478n08vckkld8r52nkc102ppqvsfhiy7skm",
+        "version": "6.4.14"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 905ce00cfc43..e189e7201088 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.130";
+  version = "5.15.131";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0qix62jsn3z9yccakac7fvqnip19zi05qn0w5wkgb7rj0x0lwimb";
+    sha256 = "0sacnbw48lblnqaj56nybh588sq4k84gwf0r5zinzyrryj8k6z4r";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 75e3abd118e6..9e14c7a6117e 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.51";
+  version = "6.1.52";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0fqhmb6v28rssd44z7jw57mwvvskpl4kabjylck0pg54irnl9c2q";
+    sha256 = "0lis73mxnl7hxz8lyja6sfgmbym944l3k1h7dab6b4mw1nckfxsn";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index 1cf9f26ba8ae..b5d9d6451324 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.14";
+  version = "6.4.15";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1rjh0jrn5qvxwzmyg478n08vckkld8r52nkc102ppqvsfhiy7skm";
+    sha256 = "1phlx375ln5pslw5vjqm029cdv6pzf4ang10xlrf90x5sb4fgy93";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.5.nix b/pkgs/os-specific/linux/kernel/linux-6.5.nix
index 3c2badfc6272..341cc84be74d 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.5.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.5.1";
+  version = "6.5.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256-I3Zd1EQlRizZKtvuUmcGCP1/P9GDqDslunp7SIPQRRs=";
+    hash = "sha256-ICfhQFfVaK093BANrfTIhTpJsDEnBHimHYj2ARVyZQ8=";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index b871c63e36d3..c6ec0866791e 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -3,6 +3,8 @@
 , coreutils
 , gnused
 , gnugrep
+, jq
+, util-linux
 , nix
 , lib
 , nixosTests
@@ -20,7 +22,7 @@ substituteAll {
   nix_x86_64_linux = fallback.x86_64-linux;
   nix_i686_linux = fallback.i686-linux;
   nix_aarch64_linux = fallback.aarch64-linux;
-  path = lib.makeBinPath [ coreutils gnused gnugrep ];
+  path = lib.makeBinPath [ coreutils gnused gnugrep jq util-linux ];
   nativeBuildInputs = [
     installShellFiles
   ];
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
index 64bbbee411d7..b0ff5b0a672f 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
@@ -10,7 +10,7 @@
 .Sh SYNOPSIS
 .Nm
 .Bro
-.Cm switch | boot | test | build | dry-build | dry-activate | edit | build-vm | build-vm-with-bootloader
+.Cm switch | boot | test | build | dry-build | dry-activate | edit | build-vm | build-vm-with-bootloader | list-generations Op Fl -json
 .Brc
 .br
 .Op Fl -upgrade | -upgrade-all
@@ -196,6 +196,14 @@ The boot loader is installed on an automatically generated virtual disk
 containing a
 .Pa /boot
 partition.
+.
+.It Cm list-generations Op Fl -json
+List the available generations in a similar manner to the boot loader
+menu. It shows the generation number, build date and time, NixOS version,
+kernel version and the configuration revision. This is useful to get
+information e.g. for which generation to roll back to with
+.Ic nixos-rebuild switch Fl -generation Ar N
+There is also a json version of output available.
 .El
 .
 .
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 89871056c482..2f89642845e2 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -36,6 +36,7 @@ verboseScript=
 noFlake=
 # comma separated list of vars to preserve when using sudo
 preservedSudoVars=NIXOS_INSTALL_BOOTLOADER
+json=
 
 # log the given argument to stderr
 log() {
@@ -48,7 +49,7 @@ while [ "$#" -gt 0 ]; do
       --help)
         showSyntax
         ;;
-      switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader)
+      switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)
         if [ "$i" = dry-run ]; then i=dry-build; fi
         # exactly one action mandatory, bail out if multiple are given
         if [ -n "$action" ]; then showSyntax; fi
@@ -146,6 +147,9 @@ while [ "$#" -gt 0 ]; do
         k="$1"; shift 1
         lockFlags+=("$i" "$j" "$k")
         ;;
+      --json)
+        json=1
+        ;;
       *)
         log "$0: unknown option \`$i'"
         exit 1
@@ -507,6 +511,87 @@ if [ "$action" = dry-build ]; then
     extraBuildFlags+=(--dry-run)
 fi
 
+if [ "$action" = list-generations ]; then
+    if [ ! -L "$profile" ]; then
+        log "No profile \`$(basename "$profile")' found"
+        exit 1
+    fi
+
+    generation_from_dir() {
+        generation_dir="$1"
+        generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123
+        no_link_gen="${generation_base%-link}"  # remove the "-link"
+        echo "${no_link_gen##*-}" # remove everything before the last dash
+    }
+    describe_generation(){
+        generation_dir="$1"
+        generation_number="$(generation_from_dir "$generation_dir")"
+        nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")"
+
+        kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")"
+        kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")"
+
+        configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)"
+
+        # Old nixos-version output ignored unknown flags and just printed the version
+        # therefore the following workaround is done not to show the default output
+        nixos_version_default="$("$generation_dir/sw/bin/nixos-version")"
+        if [ "$configurationRevision" == "$nixos_version_default" ]; then
+             configurationRevision=""
+        fi
+
+        # jq automatically quotes the output => don't try to quote it in output!
+        build_date="$(stat "$generation_dir" --format=%W | jq 'todate')"
+
+        pushd "$generation_dir/specialisation/" > /dev/null || :
+        specialisation_list=(*)
+        popd > /dev/null || :
+
+        specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")"
+
+        if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then
+            current_generation_tag="true"
+        else
+            current_generation_tag="false"
+        fi
+
+        # Escape userdefined strings
+        nixos_version="$(jq -aR <<< "$nixos_version")"
+        kernel_version="$(jq -aR <<< "$kernel_version")"
+        configurationRevision="$(jq -aR <<< "$configurationRevision")"
+        cat << EOF
+{
+  "generation": $generation_number,
+  "date": $build_date,
+  "nixosVersion": $nixos_version,
+  "kernelVersion": $kernel_version,
+  "configurationRevision": $configurationRevision,
+  "specialisations": $specialisations,
+  "current": $current_generation_tag
+}
+EOF
+    }
+
+    find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" |
+        sort -Vr |
+        while read -r generation_dir; do
+            describe_generation "$generation_dir"
+        done |
+        if [ -z "$json" ]; then
+            jq --slurp -r '.[] | [
+                    ([.generation, (if .current == true then "current" else "" end)] | join(" ")),
+                    (.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")),
+                    .nixosVersion, .kernelVersion, .configurationRevision,
+                    (.specialisations | join(" "))
+                ] | @tsv' |
+                column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation" |
+                ${PAGER:cat}
+        else
+            jq --slurp .
+        fi
+    exit 0
+fi
+
 
 # Either upgrade the configuration in the system profile (for "switch"
 # or "boot"), or just build it and create a symlink "result" in the
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
index 1613e11e0280..2ed6829f3614 100644
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_mount";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchurl {
-    url = "mirror://sourceforge/pam-mount/pam_mount/${pname}-${version}.tar.xz";
-    sha256 = "02m6w04xhgv2yx69yxph8giw0sp39s9lvvlffslyna46fnr64qvb";
+    url = "https://inai.de/files/pam_mount/${pname}-${version}.tar.xz";
+    hash = "sha256-VCYgekhWgPjhdkukBbs4w5pODIMGvIJxkQ8bgZozbO0=";
   };
 
   patches = [
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index f64183684074..8d3a490c45e1 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -38,12 +38,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
-  version = "3.12.3";
+  version = "3.12.4";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-ZtfybHy6gsLcUz5LGTQrzG/a8x+s6ZkIQsiFC845NC0=";
+    hash = "sha256-9D59IZl7zYJzkSYuFcA6IPttCI9SjacE/l04cUh3An8=";
   };
 
   nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync python3 ];
diff --git a/pkgs/servers/dict/default.nix b/pkgs/servers/dict/default.nix
index 1b3962907781..ea7cb80b8fc0 100644
--- a/pkgs/servers/dict/default.nix
+++ b/pkgs/servers/dict/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Dict protocol server and client";
     homepage = "http://www.dict.org";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/servers/dict/libmaa.nix b/pkgs/servers/dict/libmaa.nix
index b0762990f2d5..9b31732ed124 100644
--- a/pkgs/servers/dict/libmaa.nix
+++ b/pkgs/servers/dict/libmaa.nix
@@ -15,8 +15,9 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
 
   meta = with lib; {
-    description = "Dict protocol server and client";
-    maintainers = [ ];
-    platforms = platforms.linux;
+    description = "Provides many low-level data structures which are helpful for writing compilers";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/servers/gerbera/default.nix b/pkgs/servers/gerbera/default.nix
index b62237866b3f..9cd7cadc09ee 100644
--- a/pkgs/servers/gerbera/default.nix
+++ b/pkgs/servers/gerbera/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , nixosTests
@@ -74,6 +75,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-j5J0u0zIjHY2kP5P8IzN2h+QQSCwsel/iTspad6V48s=";
   };
 
+  patches = [
+    # Can be removed on the next bump, see:
+    # https://github.com/gerbera/gerbera/pull/2840.
+    (fetchpatch {
+      name = "gerbera-fmt10.patch";
+      url = "https://github.com/gerbera/gerbera/commit/37957aac0aea776e6f843af2358916f81056a405.patch";
+      hash = "sha256-U7dyFGEbelVZeHYX/4fLOC0k+9pUKZ8qP/LIVXWCMcU=";
+    })
+  ];
+
   postPatch = lib.optionalString enableMysql ''
     substituteInPlace cmake/FindMySQL.cmake \
       --replace /usr/include/mysql ${lib.getDev libmysqlclient}/include/mariadb \
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 5ab04b40f2c8..57ace965f4be 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.9.0";
+  version = "2023.9.1";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 60004331b366..e36ad7fd6db6 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -283,12 +283,12 @@ let
       });
 
       zeroconf = super.zeroconf.overridePythonAttrs (oldAttrs: rec {
-        version = "0.91.1";
+        version = "0.98.0";
         src = fetchFromGitHub {
           owner = "python-zeroconf";
           repo = "python-zeroconf";
           rev = "refs/tags/${version}";
-          hash = "sha256-HHADcxXjfukRJtqRjfKI/spZIqOfDT0Etg4oYzNdXIs=";
+          hash = "sha256-oajSXGQTsJsajRAnS/MkkbSyxTeVvdjvw1eiJaPzZMY=";
         };
       });
 
@@ -316,7 +316,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.9.0";
+  hassVersion = "2023.9.1";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -332,7 +332,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XdZYVv60ZCkK0fKmt2kmThRxhv+hfJMtHwgBu3iaW9w=";
+    hash = "sha256-uOFCaYpw/UVWdkJ3ixu8cMx9sbDy2WnHPxvPvWN1mkE=";
   };
 
   # Secondary source is git for tests
@@ -340,7 +340,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-B+GdUXRvQyBMR7PbVGEZr7hZm7wslBskUTB23APJLIU=";
+    hash = "sha256-rglLwAlHlwoaF/RxUsKc8+f38D6ztMh2p2fkHLWq9MM=";
   };
 
   nativeBuildInputs = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 72da8c22120d..53861ae2c4f3 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20230906.1";
+  version = "20230908.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-wR/v49K4bKNnzkRltvdFjVYgZ+jU8PVBJHCF765NY5U=";
+    hash = "sha256-XZAdS4RjnPmMXYzBmyA4+liH5kdm3U/YqJJGXIaqOGo=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
index 646dfc3728d1..42d62539b6b3 100644
--- a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
+++ b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
@@ -1,14 +1,26 @@
-{ lib, buildPythonPackage, fetchFromGitHub, matrix-synapse, twisted, humanize, boto3, tqdm }:
+{ lib
+, boto3
+, buildPythonPackage
+, fetchFromGitHub
+, humanize
+, matrix-synapse-unwrapped
+, pythonOlder
+, tqdm
+, twisted
+}:
 
 buildPythonPackage rec {
   pname = "matrix-synapse-s3-storage-provider";
   version = "1.2.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse-s3-storage-provider";
-    rev = "v${version}";
-    sha256 = "sha256-92Xkq54jrUE2I9uVOxI72V9imLNU6K4JqDdOZb+4f+Y=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-92Xkq54jrUE2I9uVOxI72V9imLNU6K4JqDdOZb+4f+Y=";
   };
 
   postPatch = ''
@@ -16,17 +28,30 @@ buildPythonPackage rec {
       --replace "humanize>=0.5.1,<0.6" "humanize>=0.5.1"
   '';
 
-  doCheck = false;
-  pythonImportsCheck = [ "s3_storage_provider" ];
+  buildInputs = [
+    matrix-synapse-unwrapped
+  ];
 
-  buildInputs = [ matrix-synapse ];
-  propagatedBuildInputs = [ twisted humanize boto3 tqdm ]
-    # for the s3_media_upload script
-    ++ matrix-synapse.propagatedBuildInputs;
+  propagatedBuildInputs = [
+    boto3
+    humanize
+    tqdm
+    twisted
+  ]
+  # For the s3_media_upload script
+  ++ matrix-synapse-unwrapped.propagatedBuildInputs;
+
+  # Tests need network access
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "s3_storage_provider"
+  ];
 
   meta = with lib; {
     description = "Synapse storage provider to fetch and store media in Amazon S3";
     homepage = "https://github.com/matrix-org/synapse-s3-storage-provider";
+    changelog = "https://github.com/matrix-org/synapse-s3-storage-provider/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ yuka ];
   };
diff --git a/pkgs/servers/nosql/influxdb2/default.nix b/pkgs/servers/nosql/influxdb2/default.nix
index 6a78aa70ee60..c103a0f086fc 100644
--- a/pkgs/servers/nosql/influxdb2/default.nix
+++ b/pkgs/servers/nosql/influxdb2/default.nix
@@ -1,6 +1,7 @@
 { buildGoModule
 , fetchFromGitHub
 , fetchurl
+, fetchpatch
 , go-bindata
 , lib
 , perl
@@ -12,23 +13,20 @@
 }:
 
 let
-  version = "2.5.1";
-  # Despite the name, this is not a rolling release. This is the
-  # version of the UI assets for 2.5.1, as specified in
-  # scripts/fetch-ui-assets.sh in the 2.5.1 tag of influxdb.
-  ui_version = "OSS-2022-09-16";
-  libflux_version = "0.188.1";
+  version = "2.7.1";
+  ui_version = "OSS-v${version}";
+  libflux_version = "0.193.0";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "influxdb";
     rev = "v${version}";
-    sha256 = "sha256-AKyuFBja06BuWYliqIGKOb4PIc5G8S9S+cf/dLrEATY=";
+    hash = "sha256-JWu4V2k8ItbzBa421EtzgMVlDznoDdGjIhfDSaZ0j6c=";
   };
 
   ui = fetchurl {
     url = "https://github.com/influxdata/ui/releases/download/${ui_version}/build.tar.gz";
-    sha256 = "sha256-YKDp1jLyo4n+YTeMaWl8dhN4Lr3H8FXV7stJ3p3zFe8=";
+    hash = "sha256-0k59SKvt9pFt3WSd5PRUThbfbctt2RYtaxaxoyLICm8=";
   };
 
   flux = rustPlatform.buildRustPackage {
@@ -38,10 +36,21 @@ let
       owner = "influxdata";
       repo = "flux";
       rev = "v${libflux_version}";
-      sha256 = "sha256-Xmh7V/o1Gje62kcnTeB9h/fySljhfu+tjbyvryvIGRc=";
+      hash = "sha256-gx6vnGOFu35wasLl7X/73eDsE0/50cAzjmBjZ+H2Ne4=";
     };
+    patches = [
+      # Fix build with recent rust versions
+      (fetchpatch {
+        url = "https://github.com/influxdata/flux/commit/6dc8054cfeec4b65b5c7ae786d633240868b8589.patch";
+        stripLen = 2;
+        extraPrefix = "";
+        excludes = [ "rust-toolchain.toml" ];
+        hash = "sha256-w3z+Z26Xhy9TNICyNhc8XiWNSpdLA23ADI4K/AOMYhg=";
+      })
+      ./no-deny-warnings.patch
+    ];
     sourceRoot = "${src.name}/libflux";
-    cargoSha256 = "sha256-9rPW0lgi3lXJARa1KXgSY8LVJsoFjppok5ODGlqYeYw=";
+    cargoSha256 = "sha256-MoI5nxLGA/3pduZ+vgmSG3lm3Nx58SP+6WXQl2pX9Lc=";
     nativeBuildInputs = [ rustPlatform.bindgenHook ];
     buildInputs = lib.optional stdenv.isDarwin libiconv;
     pkgcfg = ''
@@ -69,7 +78,7 @@ in buildGoModule {
 
   nativeBuildInputs = [ go-bindata pkg-config perl ];
 
-  vendorSha256 = "sha256-02x+HsWkng7OnKVSfkQR8LL1Qk42Bdrw0IMtBpS7xQc=";
+  vendorSha256 = "sha256-5b1WRq3JndkOkKBhMzGZnSyBDY5Lk0UGe/WGHQJp0CQ=";
   subPackages = [ "cmd/influxd" "cmd/telemetryd" ];
 
   PKG_CONFIG_PATH = "${flux}/pkgconfig";
diff --git a/pkgs/servers/nosql/influxdb2/no-deny-warnings.patch b/pkgs/servers/nosql/influxdb2/no-deny-warnings.patch
new file mode 100644
index 000000000000..3000ccad8256
--- /dev/null
+++ b/pkgs/servers/nosql/influxdb2/no-deny-warnings.patch
@@ -0,0 +1,10 @@
+diff --git a/flux/src/lib.rs b/flux/src/lib.rs
+index 3fdf4071..a4c02277 100644
+--- a/flux/src/lib.rs
++++ b/flux/src/lib.rs
+@@ -1,5 +1,3 @@
+-#![cfg_attr(feature = "strict", deny(warnings, missing_docs))]
+-
+ //! This module provides the public facing API for Flux's Go runtime, including formatting,
+ //! parsing, and standard library analysis.
+ use std::sync::Arc;
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 4e5079206bdc..58ee4cab598f 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.16.10";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
-    repo = pname;
+    repo = "pocketbase";
     rev = "v${version}";
-    sha256 = "sha256-BH3hJ+5xAJkGj2HoKpee+ZNgMmyQoHEVI0wsXRwIdGw=";
+    hash = "sha256-UwxE36y99vW/45Lnkm5qaevEToxIVs73YUJVDtr8ziA=";
   };
 
-  vendorHash = "sha256-h3lkmpHEMr/aueP+lJpa9HJCidEpm7xSKws28+ZSeQA=";
+  vendorHash = "sha256-vb0957zO27OgrSTUiAt+vuo9NKM5ftz8mbFf613l0eM=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
@@ -32,11 +32,6 @@ buildGoModule rec {
     mv $out/bin/base $out/bin/pocketbase
   '';
 
-  patches = [
-    # To provide a consistent update experience, we remove the built in update method
-    ./remove-update-method.patch
-  ];
-
   meta = with lib; {
     description = "Open Source realtime backend in 1 file";
     homepage = "https://github.com/pocketbase/pocketbase";
diff --git a/pkgs/servers/pocketbase/remove-update-method.patch b/pkgs/servers/pocketbase/remove-update-method.patch
deleted file mode 100644
index a68ae58bd0ba..000000000000
--- a/pkgs/servers/pocketbase/remove-update-method.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/examples/base/main.go b/examples/base/main.go
-index 908d31d..04b8f1d 100644
---- a/examples/base/main.go
-+++ b/examples/base/main.go
-@@ -10,7 +10,6 @@ import (
- 	"github.com/pocketbase/pocketbase"
- 	"github.com/pocketbase/pocketbase/apis"
- 	"github.com/pocketbase/pocketbase/core"
--	"github.com/pocketbase/pocketbase/plugins/ghupdate"
- 	"github.com/pocketbase/pocketbase/plugins/jsvm"
- 	"github.com/pocketbase/pocketbase/plugins/migratecmd"
- )
-@@ -80,9 +79,6 @@ func main() {
- 		Dir:          migrationsDir,
- 	})
- 
--	// GitHub selfupdate
--	ghupdate.MustRegister(app, app.RootCmd, nil)
--
- 	app.OnAfterBootstrap().Add(func(e *core.BootstrapEvent) error {
- 		app.Dao().ModelQueryTimeout = time.Duration(queryTimeout) * time.Second
- 		return nil
diff --git a/pkgs/servers/soft-serve/default.nix b/pkgs/servers/soft-serve/default.nix
index c8113dc3ad98..6801c680b6ec 100644
--- a/pkgs/servers/soft-serve/default.nix
+++ b/pkgs/servers/soft-serve/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "soft-serve";
-  version = "0.5.5";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     rev = "v${version}";
-    sha256 = "sha256-+jtB6OuoMSF3w5TfW2Q+LaP+8VKC1EpWU4mWZbBDNDM=";
+    hash = "sha256-LrqkLZ7ouMUrE3vHYC0ZwmblaYL6b5fY2RYEYOOxNYQ=";
   };
 
-  vendorHash = "sha256-wf2Dfo4uWHg/h2+EfEW5oGUgqf1kAgiTq7ivczI1w+c=";
+  vendorHash = "sha256-RQQvR4d5dtzboPYJwdeUqfGwSun04gs7hm1YYAt8OPo=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/xandikos/default.nix b/pkgs/servers/xandikos/default.nix
index f6afb09819f8..e5238b90814f 100644
--- a/pkgs/servers/xandikos/default.nix
+++ b/pkgs/servers/xandikos/default.nix
@@ -6,34 +6,37 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "xandikos";
-  version = "0.2.8";
+  version = "0.2.10";
+  format = "pyproject";
+
+  disabled = python3Packages.pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "jelmer";
     repo = "xandikos";
     rev = "v${version}";
-    sha256 = "sha256-KDDk0QSOjwivJFz3vLk+g4vZMlSuX2FiOgHJfDJkpwg=";
+    hash = "sha256-SqU/K3b8OML3PvFmP7L5R3Ub9vbW66xRpf79mgFZPfc=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+    wheel
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     aiohttp
+    aiohttp-openmetrics
     dulwich
     defusedxml
     icalendar
     jinja2
     multidict
-    prometheus-client
+    vobject
   ];
 
   passthru.tests.xandikos = nixosTests.xandikos;
 
   nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
-  disabledTests = [
-    # these tests are failing due to the following error:
-    # TypeError: expected str, bytes or os.PathLike object, not int
-    "test_iter_with_etag"
-    "test_iter_with_etag_missing_uid"
-  ];
 
   meta = with lib; {
     description = "Lightweight CalDAV/CardDAV server";
diff --git a/pkgs/tools/admin/aws-nuke/default.nix b/pkgs/tools/admin/aws-nuke/default.nix
index c3f6cb2da5c2..2529cbc21a6b 100644
--- a/pkgs/tools/admin/aws-nuke/default.nix
+++ b/pkgs/tools/admin/aws-nuke/default.nix
@@ -1,20 +1,23 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, installShellFiles
 }:
 
 buildGoModule rec {
   pname = "aws-nuke";
-  version = "2.24.2";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "rebuy-de";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Zy+ULmGDUK4KGMJ5PXTyT8CSp0nC71AW/4Udl2ElOCg=";
+    hash = "sha256-Yc9GXdcSKPvwddh+QU2/pBC0XIqA53wpd0VNKOqppbU=";
   };
 
-  vendorHash = "sha256-srQuR9ZoTjZR1XfewFv7wF188Q5FggMdicm71v6MY/8=";
+  vendorHash = "sha256-FZ92JoyPYysYhl7iQZ8X32BDyNKL1UbOgq7EhHyqb5A=";
+
+  nativeBuildInputs = [ installShellFiles ];
 
   overrideModAttrs = _: {
     preBuild = ''
@@ -26,9 +29,19 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
+  ldflags = [ "-s" "-w" ];
+
+  postInstall = ''
+    installShellCompletion --cmd aws-nuke \
+      --bash <($out/bin/aws-nuke completion bash) \
+      --fish <($out/bin/aws-nuke completion fish) \
+      --zsh <($out/bin/aws-nuke completion zsh)
+  '';
+
   meta = with lib; {
     description = "Nuke a whole AWS account and delete all its resources";
     homepage = "https://github.com/rebuy-de/aws-nuke";
+    changelog = "https://github.com/rebuy-de/aws-nuke/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ grahamc ];
   };
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 1af08922edce..aa654d522a52 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -11,12 +11,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3006.2";
+  version = "3006.3";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+I0aJeIw2co9/eE9rdRmB6KxdQq1WoY1nFpCUedx8Wc=";
+    hash = "sha256-flP7zETEn41uZ8sZytoGOADKKe1/Fa+XJSdTGqhW5Cs=";
   };
 
   patches = [
diff --git a/pkgs/tools/backup/discordchatexporter-cli/default.nix b/pkgs/tools/backup/discordchatexporter-cli/default.nix
index dee8691981d8..0216ab6bff36 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/default.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildDotnetModule
+, dotnetCorePackages
 , fetchFromGitHub
 , testers
 , discordchatexporter-cli
@@ -7,17 +8,19 @@
 
 buildDotnetModule rec {
   pname = "discordchatexporter-cli";
-  version = "2.36.1";
+  version = "2.40.4";
 
   src = fetchFromGitHub {
     owner = "tyrrrz";
     repo = "discordchatexporter";
     rev = version;
-    sha256 = "svBVXny8ZsZnXG5cDPDKlR2dNhPzPOW4VGaOZkLrRNA=";
+    hash = "sha256-XmUTGVOU67fSX0mZg2f5j8pb6ID7amzJpD4F7u6f3GM=";
   };
 
   projectFile = "DiscordChatExporter.Cli/DiscordChatExporter.Cli.csproj";
   nugetDeps = ./deps.nix;
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.runtime_7_0;
 
   postFixup = ''
     ln -s $out/bin/DiscordChatExporter.Cli $out/bin/discordchatexporter-cli
@@ -36,7 +39,8 @@ buildDotnetModule rec {
     homepage = "https://github.com/Tyrrrz/DiscordChatExporter";
     license = licenses.gpl3Plus;
     changelog = "https://github.com/Tyrrrz/DiscordChatExporter/blob/${version}/Changelog.md";
-    maintainers = [ maintainers.ivar ];
+    maintainers = with maintainers; [ eclairevoyant ivar ];
     platforms = [ "x86_64-linux" ];
+    mainProgram = "discordchatexporter-cli";
   };
 }
diff --git a/pkgs/tools/backup/discordchatexporter-cli/deps.nix b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
index 3eeae7e78824..de52148198c5 100644
--- a/pkgs/tools/backup/discordchatexporter-cli/deps.nix
+++ b/pkgs/tools/backup/discordchatexporter-cli/deps.nix
@@ -3,14 +3,19 @@
 
 { fetchNuGet }: [
   (fetchNuGet { pname = "AdvancedStringBuilder"; version = "0.1.0"; sha256 = "1lpv5sggdxza0bmcqmzf5r4i340f0m7nr5073lac18naj5697q5g"; })
-  (fetchNuGet { pname = "CliFx"; version = "2.3.0"; sha256 = "0dxxd5hm7gnc1lhq7k266nkcl84w0844r3cdxdcksvcc786f43vp"; })
-  (fetchNuGet { pname = "DotnetRuntimeBootstrapper"; version = "2.3.1"; sha256 = "0zsicyizachdam64mjm1brh5a3nzf7j8nalyhwnw26wk3v3rgmc9"; })
-  (fetchNuGet { pname = "Gress"; version = "2.0.1"; sha256 = "00xhyfkrlc38nbl6aymr7zwxc3kj0rxvx5gwk6fkfrvi1pzgq0wc"; })
+  (fetchNuGet { pname = "AngleSharp"; version = "1.0.4"; sha256 = "1b4qd0z27fdkgy5l8fqcbpzwm29gmmjm2h0mqb9ac94rv6ynq510"; })
+  (fetchNuGet { pname = "AsyncKeyedLock"; version = "6.2.1"; sha256 = "0281mj9ppz6q454li6xyllb1hdfkl59bh3psbj4z6l9xjbhnjhz0"; })
+  (fetchNuGet { pname = "CliFx"; version = "2.3.4"; sha256 = "14nj8w3j0hbsr5cghj39jx2sh5cg3wsvl517dk8whva5kgy3q1mf"; })
+  (fetchNuGet { pname = "Deorcify"; version = "1.0.2"; sha256 = "0nwxyrl4rd5x621i2hs5fl3w7fxpm13lkdssxr9fd5042px2gqbm"; })
+  (fetchNuGet { pname = "DotnetRuntimeBootstrapper"; version = "2.5.1"; sha256 = "192795akjmdxvp8p52g256rg0nzriipfsr8j808h69j6himhp4d7"; })
+  (fetchNuGet { pname = "Gress"; version = "2.1.1"; sha256 = "1svz1flhyl26h3xjch0acjjinympgf6bhj5vpb188njfih3ip4ck"; })
   (fetchNuGet { pname = "JsonExtensions"; version = "1.2.0"; sha256 = "0g54hibabbqqfhxjlnxwv1rxagpali5agvnpymp2w3dk8h6q66xy"; })
-  (fetchNuGet { pname = "MiniRazor.CodeGen"; version = "2.2.2"; sha256 = "11mxv1p7ahjzpf3sgacfx6szv1xwwk33vpz1r6wb2nch5dx93vdx"; })
-  (fetchNuGet { pname = "MiniRazor.Runtime"; version = "2.2.2"; sha256 = "1bjnqx06gzc13kpbhyndzfrvwgmxi7j0nbaxm7cmb1g7zq06vzrb"; })
-  (fetchNuGet { pname = "Polly"; version = "7.2.3"; sha256 = "1iws4jd5iqj5nlfp16fg9p5vfqqas1si0cgh8xcj64y433a933cv"; })
-  (fetchNuGet { pname = "Spectre.Console"; version = "0.44.0"; sha256 = "0f4q52rmib0q3vg7ij6z73mnymyas7c7wrm8dfdhrkdzn53zwl6p"; })
+  (fetchNuGet { pname = "Polly"; version = "7.2.4"; sha256 = "0lvhi2a18p6ay780lbw18656297s9i45cvpp4dr9k5lhg7fwl2y1"; })
+  (fetchNuGet { pname = "RazorBlade"; version = "0.4.3"; sha256 = "1wnp7dd1ir9w1ipp424h4f3z832b6i1dx1cljyf1ry9lrb3i91is"; })
+  (fetchNuGet { pname = "Spectre.Console"; version = "0.47.0"; sha256 = "0gc9ana660an7d76w9qd8l62lv66dc69vr5lslr896b1313ywakp"; })
   (fetchNuGet { pname = "Superpower"; version = "3.0.0"; sha256 = "0p6riay4732j1fahc081dzgs9q4z3n2fpxrin4zfpj6q2226dhz4"; })
-  (fetchNuGet { pname = "WebMarkupMin.Core"; version = "2.12.0"; sha256 = "1v4dcrpz2icm73w1pfrcjanx0x4j1khi65pyf1xd712lfpm7gpyd"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "7.0.0"; sha256 = "0sn6hxdjm7bw3xgsmg041ccchsa4sp02aa27cislw3x61dbr68kq"; })
+  (fetchNuGet { pname = "WebMarkupMin.Core"; version = "2.14.0"; sha256 = "0c41zw1bwz6ybxagq5vr26cx7najd17rrdbqjpn8mabynq380ayr"; })
+  (fetchNuGet { pname = "YoutubeExplode"; version = "6.3.1"; sha256 = "1rkj7rjm8vl4lygfqbil5cgj271wvnhcdpcybb74m6mlf7w7dg1q"; })
 ]
diff --git a/pkgs/tools/graphics/dnglab/default.nix b/pkgs/tools/graphics/dnglab/default.nix
index eafed87ba1f8..cb865e51a9c5 100644
--- a/pkgs/tools/graphics/dnglab/default.nix
+++ b/pkgs/tools/graphics/dnglab/default.nix
@@ -4,16 +4,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "dnglab";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "dnglab";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4uTpCBzBBkcpVBVZMOBD6f9ut71OuUNQ5+AkaQcU86M=";
+    sha256 = "sha256-jkOkkcMFK1RLY8Hn/bMMuMZtyGwnwGdm0os8QKhcWqo=";
   };
 
-  cargoSha256 = "sha256-WvXQNDYvR6s4M2Hlpqwq1/wFQYW2QU/ngQimKOFkhOQ=";
+  cargoSha256 = "sha256-qwhOJxFYRJC51dKB1pi/WVJs7H955jM6KmKbxsAScDI=";
 
   postInstall = ''
     rm $out/bin/benchmark $out/bin/identify
diff --git a/pkgs/tools/graphics/epstool/default.nix b/pkgs/tools/graphics/epstool/default.nix
index 6910f458a17d..cdb1f75cb2c3 100644
--- a/pkgs/tools/graphics/epstool/default.nix
+++ b/pkgs/tools/graphics/epstool/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "3.08";
+  version = "3.09";
   pname = "epstool";
 
   src = fetchurl {
-    url = "http://ftp.de.debian.org/debian/pool/main/e/epstool/epstool_${version}+repack.orig.tar.gz";
-    sha256 = "1pfgqbipwk36clhma2k365jkpvyy75ahswn8jczzys382jalpwgk";
+    url = "http://ftp.de.debian.org/debian/pool/main/e/epstool/epstool_${version}.orig.tar.xz";
+    hash = "sha256-HoUknRpE+UGLH5Wjrr2LB4TauOSd62QXrJuZbKCPYBE=";
   };
 
   makeFlags = [
@@ -19,8 +19,6 @@ stdenv.mkDerivation rec {
     make EPSTOOL_ROOT=$out install
   '';
 
-  patches = [ ./gcc43.patch ];
-
   meta = with lib; {
     description = "A utility to create or extract preview images in EPS files, fix bounding boxes and convert to bitmaps";
     homepage = "http://pages.cs.wisc.edu/~ghost/gsview/epstool.htm";
diff --git a/pkgs/tools/graphics/epstool/gcc43.patch b/pkgs/tools/graphics/epstool/gcc43.patch
deleted file mode 100644
index 398ce08c5182..000000000000
--- a/pkgs/tools/graphics/epstool/gcc43.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- epstool-3.08.orig/src/epstool.c	2005-06-10 04:41:00.000000000 -0500
-+++ epstool-3.08/src/epstool.c	2009-02-16 20:55:43.186140029 -0600
-@@ -2824,7 +2824,7 @@
- 		code = -1;
- 	}
- 	if ((code==0) && stdout_name && (hChildStdoutWr == -1)) {
--	    handle = open(stdout_name, O_WRONLY | O_CREAT);
-+	    handle = open(stdout_name, O_WRONLY | O_CREAT, 0644);
- 	    hChildStdoutWr = dup2(handle, 1);
- 	    if (handle != -1)
- 		close(handle);
-@@ -2832,7 +2832,7 @@
- 		code = -1;
- 	}
- 	if ((code==0) && stderr_name && (hChildStderrWr == -1)) {
--	    handle = open(stderr_name, O_WRONLY | O_CREAT);
-+	    handle = open(stderr_name, O_WRONLY | O_CREAT, 0644);
- 	    hChildStderrWr = dup2(handle, 2);
- 	    if (handle != -1)
- 		close(handle);
diff --git a/pkgs/tools/graphics/maskromtool/default.nix b/pkgs/tools/graphics/maskromtool/default.nix
index f36932e3be4d..6202cdf54815 100644
--- a/pkgs/tools/graphics/maskromtool/default.nix
+++ b/pkgs/tools/graphics/maskromtool/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "maskromtool";
-  version = "2023-07-20";
+  version = "2023-08-06";
 
   src = fetchFromGitHub {
     owner = "travisgoodspeed";
     repo = "maskromtool";
     rev = "v${version}";
-    hash = "sha256-AUZh1GAGN5RUXyK+YvQfhAp124bSI0LvCSaTRutLuE4=";
+    hash = "sha256-CsGa+MQP0EtG3cPxhD1ymZt20QsYMh94XWppbLdvIaE=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/graphics/vulkan-caps-viewer/default.nix b/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
index 047ab022aae4..b2a9781f23ec 100644
--- a/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
+++ b/pkgs/tools/graphics/vulkan-caps-viewer/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-caps-viewer";
-  version = "3.31";
+  version = "3.32";
 
   src = fetchFromGitHub {
     owner = "SaschaWillems";
     repo = "VulkanCapsViewer";
     rev = version;
-    hash = "sha256-+cJtJPpEFHyy+CbPm0IB2nDa7FM1JY8NOsqGB/WIY2A=";
+    hash = "sha256-SPz8AurANjNwtsPHdZ2lCaC3VEcEAKn93st/7DJ0oyU=";
     # Note: this derivation strictly requires vulkan-header to be the same it was developed against.
     # To help us, they've put it in a git-submodule.
     # The result will work with any vulkan-loader version.
diff --git a/pkgs/tools/misc/dabet/default.nix b/pkgs/tools/misc/dabet/default.nix
index 3440a6e561b3..da7cbce191c2 100644
--- a/pkgs/tools/misc/dabet/default.nix
+++ b/pkgs/tools/misc/dabet/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dabet";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "annaaurora";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B5z2RUkvztnGCKeVsjp/yzrI8m/6mjBB0DS1yhFZhM4=";
+    hash = "sha256-BYE+GGwf84zENf+lPS98OzZQbXxd7kykWL+B3guyVNI=";
   };
 
-  cargoSha256 = "sha256-v1lc2quqxuNUbBQHaTtIDUPPTMyz8nj+TNCdSjrfrOA=";
+  cargoHash = "sha256-kguQmCXP5+E6e8CSKP18faa93VKToU2pcQixDOBrd+8=";
 
   meta = with lib; {
     description = "Print the duration between two times";
diff --git a/pkgs/tools/misc/github-copilot-cli/default.nix b/pkgs/tools/misc/github-copilot-cli/default.nix
index 8a25454eccee..a6c5e7477d49 100644
--- a/pkgs/tools/misc/github-copilot-cli/default.nix
+++ b/pkgs/tools/misc/github-copilot-cli/default.nix
@@ -20,7 +20,7 @@ buildNpmPackage rec {
   meta = with lib; {
     description = "A CLI experience for letting GitHub Copilot help you on the command line";
     homepage = "https://githubnext.com/projects/copilot-cli/";
-    license = licenses.free;
+    license = licenses.unfree; # upstream has no license
     maintainers = [ maintainers.malo ];
     platforms = platforms.all;
   };
diff --git a/pkgs/tools/misc/tgpt/default.nix b/pkgs/tools/misc/tgpt/default.nix
index 4589eff9fcd6..325ed8dc01fa 100644
--- a/pkgs/tools/misc/tgpt/default.nix
+++ b/pkgs/tools/misc/tgpt/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "1.7.6";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XPHWD9R6XdUU7gsI3rQ55DZx06Kaqgdkw08x+VsGc1g=";
+    hash = "sha256-fVDwKNj4XHMWP30f4ASKQ3m5stlQJ/6zOCwVhUfP39c=";
   };
 
   vendorHash = "sha256-2I5JJWxM6aZx0eZu7taUTL11Y/5HIrXYC5aezrTbbsM=";
diff --git a/pkgs/tools/networking/qcal/default.nix b/pkgs/tools/networking/qcal/default.nix
index efb06fd1be6d..31e800394954 100644
--- a/pkgs/tools/networking/qcal/default.nix
+++ b/pkgs/tools/networking/qcal/default.nix
@@ -18,12 +18,12 @@ buildGoModule rec {
   # to that config file in the nix store
   preBuild = ''
     substituteInPlace helpers.go \
-      --replace " config-sample.json " " $out/share/config-sample.json "
+      --replace " config-sample.json " " $out/share/qcal/config-sample.json "
   '';
 
   postInstall = ''
-    mkdir -p $out/share
-    cp config-sample.json $out/share/
+    mkdir -p $out/share/qcal
+    cp config-sample.json $out/share/qcal/
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/qcard/default.nix b/pkgs/tools/networking/qcard/default.nix
new file mode 100644
index 000000000000..16ffb5d686fe
--- /dev/null
+++ b/pkgs/tools/networking/qcard/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildGoModule
+, fetchFromSourcehut
+}:
+
+buildGoModule rec {
+  pname = "qcard";
+  version = "0.7.1";
+
+  src = fetchFromSourcehut {
+    owner = "~psic4t";
+    repo = "qcard";
+    rev = version;
+    hash = "sha256-OwmJSeAOZTX7jMhoLHSIJa0jR8zCadISQF/PqFqltRY=";
+  };
+
+  vendorHash = null;
+
+  # Replace "config-sample.json" in error message with the absolute path
+  # to that config file in the nix store
+  preBuild = ''
+    substituteInPlace helpers.go \
+      --replace " config-sample.json " " $out/share/qcard/config-sample.json "
+  '';
+
+  postInstall = ''
+    mkdir -p $out/share/qcard
+    cp config-sample.json $out/share/qcard/
+  '';
+
+  meta = {
+    description = "CLI addressbook application for CardDAV servers written in Go";
+    homepage = "https://git.sr.ht/~psic4t/qcard";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "qcard";
+    maintainers = with lib.maintainers; [ antonmosich ];
+  };
+}
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index d40754cd7911..6d810aaee62e 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "xray";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "XTLS";
     repo = "Xray-core";
     rev = "v${version}";
-    hash = "sha256-j7lIRGO+hUYAM/FWCb8cNoh6lXXE0ZboWA/Hmi9w/Bc=";
+    hash = "sha256-Hu0BP4BzoELRjJ8WdF3JS/ffxd3bpH+kauWqaMh/o1I=";
   };
 
-  vendorHash = "sha256-sBbidDvsYvFg3EqsA59MYZULim/LbrZcInixiKfwqqQ=";
+  vendorHash = "sha256-ihTOKtppOTYdulzwIwD8oWaS2OPs+QCdqPTvqucw7xY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/package-management/poetry/default.nix b/pkgs/tools/package-management/poetry/default.nix
index beb1a98bb6a1..4d4a98491cb9 100644
--- a/pkgs/tools/package-management/poetry/default.nix
+++ b/pkgs/tools/package-management/poetry/default.nix
@@ -10,6 +10,9 @@ let
       poetry = self.callPackage ./unwrapped.nix { };
 
       # version overrides required by poetry and its plugins
+      deepdiff = super.deepdiff.overridePythonAttrs (old: rec {
+        doCheck = false;
+      });
       poetry-core = super.poetry-core.overridePythonAttrs (old: rec {
         version = "1.7.0";
         src = fetchFromGitHub {
@@ -18,6 +21,7 @@ let
           rev = version;
           hash = "sha256-OfY2zc+5CgOrgbiPVnvMdT4h1S7Aek8S7iThl6azmsk=";
         };
+        patches = [ ];
       });
     } // (plugins self);
   };
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index a9b902f80d3b..b962b06e48cd 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -122,7 +122,7 @@ buildNpmPackage' {
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=${electron}/lib/electron \
+      -c.electronDist=${electron}/libexec/electron \
       -c.electronVersion=${electron.version}
 
     popd
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 41055fdba551..fc8088b9f969 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-09-08";
+  version = "2023-09-09";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5KH6B205WBJLyIAifWB7uA/LPy6dJC/xaryD6XsZCyc=";
+    hash = "sha256-AO8iuQZMipt7Va9FUmdT0wCcZhuKNU44jFL7MpVN3AM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 7705961e5b1a..9bec75f5cc45 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.32"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.33"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index c3be1dbeb83d..320f279140c4 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: d644909dcaa8814f9d8ef53d18bf7fa63d197897
-  ref: refs/tags/6.3.32
+  revision: 61956404cadf364417ec02b4cb7025b50a866565
+  ref: refs/tags/6.3.33
   specs:
-    metasploit-framework (6.3.32)
+    metasploit-framework (6.3.33)
       actionpack (~> 7.0)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 402a977db21e..c02fed2bd299 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.32";
+  version = "6.3.33";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-3aiHBaYxrpe/KSF2LiafcANIgWvZEp1kgRXry3/uWvY=";
+    sha256 = "sha256-S/uazRDWK1AqLT2QTKiluRmcwy82PZitezQMw1Kb9no=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 553a62f79628..96072bcc8f73 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -654,12 +654,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "d644909dcaa8814f9d8ef53d18bf7fa63d197897";
-      sha256 = "1xjsxrzwpsqmh5j9s4nrdf0lh0vhkwk2wxi156zrgbiilq2qga6x";
+      rev = "61956404cadf364417ec02b4cb7025b50a866565";
+      sha256 = "0ypnkd9c631lgfnrhg9n5z1rq6drlnl4r41x5lm50ayn236rmysb";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.32";
+    version = "6.3.33";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/openpgp-card-tools/default.nix b/pkgs/tools/security/openpgp-card-tools/default.nix
index c035458c6c32..6a630883580b 100644
--- a/pkgs/tools/security/openpgp-card-tools/default.nix
+++ b/pkgs/tools/security/openpgp-card-tools/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , rustPlatform
-, fetchCrate
+, fetchFromGitea
 , pkg-config
 , pcsclite
 , nettle
@@ -12,14 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "openpgp-card-tools";
-  version = "0.9.3";
+  version = "0.9.4";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-F+j8bK0sBBLWlQzLAcvl6BdiI3Dy8ollwTpL7929nJ8=";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "openpgp-card";
+    repo = "openpgp-card-tools";
+    rev = "v${version}";
+    hash = "sha256-ISIABjuh0BC6OUFa5I9Wou+av7Dp4bZH8Aazi6x7cqY=";
   };
 
-  cargoHash = "sha256-Wn3fXAft+sju8FhX6YFHRvqt815NhTlfhLJarSemvm0=";
+  cargoHash = "sha256-+EEpoI9OQvnJR6bVbEuLn3O7w6BchjBzr+oMGsWdP/k=";
 
   nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ pcsclite nettle ] ++ lib.optionals stdenv.isDarwin [ PCSC ];
diff --git a/pkgs/tools/security/pwgen/default.nix b/pkgs/tools/security/pwgen/default.nix
index 7870add420b0..3c0ce6b21d50 100644
--- a/pkgs/tools/security/pwgen/default.nix
+++ b/pkgs/tools/security/pwgen/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tytso/pwgen";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "pwgen";
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/tools/security/quark-engine/default.nix b/pkgs/tools/security/quark-engine/default.nix
index 0a3de075f810..c855fdde9333 100644
--- a/pkgs/tools/security/quark-engine/default.nix
+++ b/pkgs/tools/security/quark-engine/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
-  version = "23.6.1";
+  version = "23.8.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-RkYLTZ40ZINg3cNPBJrSOGOzSSfislBmwdUOQHDu32U=";
+    sha256 = "sha256-sdhTrRh6xkkIDZDGE22hSr5dD179VWdMVs6L1cJ9yiw=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/sn0int/default.nix b/pkgs/tools/security/sn0int/default.nix
index 96f0e44716c5..397f7eb832e7 100644
--- a/pkgs/tools/security/sn0int/default.nix
+++ b/pkgs/tools/security/sn0int/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sn0int";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+LplLeczLS+9EG0tZsiEs162/65zMCZfDDEq0iYQrGY=";
+    hash = "sha256-ze4OFKUuc/t6tXgmoWFFDjpAQraSY6RIekkcDBctPJo=";
   };
 
-  cargoHash = "sha256-FpoRO2g+R+Fo146kM0W8b1LHTEBHbGXURoX5jJk7lqY=";
+  cargoHash = "sha256-PAKmoifqB1YC02fVF2SRbXAAGrMcB+Wlvr3FwuqmPVU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/security/steamguard-cli/default.nix b/pkgs/tools/security/steamguard-cli/default.nix
new file mode 100644
index 000000000000..b5c53ac3ee24
--- /dev/null
+++ b/pkgs/tools/security/steamguard-cli/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "steamguard-cli";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "dyc3";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-WCEMZTi9/EI8JaUM5w2xJkx0x3DoaByORgVqw1TPcgI=";
+  };
+
+  cargoHash = "sha256-FVjL0tFndJNsL5oZSSqBvMtCEPqzf5xZGd8NaV5nmr4=";
+
+  meta = with lib; {
+    changelog = "https://github.com/dyc3/steamguard-cli/releases/tag/v${version}";
+    description = "A linux utility for generating 2FA codes for Steam and managing Steam trade confirmations.";
+    homepage = "https://github.com/dyc3/steamguard-cli";
+    license = with licenses; [ gpl3Only ];
+    mainProgram = "steamguard";
+    maintainers = with maintainers; [ surfaceflinger ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 8a4b1cf54d46..453cb0d14ac2 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.54.3";
+  version = "3.54.4";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nd0Qog4bwtAlXtDIXdE/mTSEBbBBUWT4FJkyl32PCVI=";
+    hash = "sha256-VWFGM4kRPrcdRwrzKrlbHl+eCpvnpYB2MD1ziPYJwjA=";
   };
 
   vendorHash = "sha256-zYvKhhwN5TtJQxkkcY5U9LtTdMb97ucfksxpTMKH/Zc=";
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index 666a8ff4271c..19d525cc5883 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-3/oGuK+n0NGDdRYb+c0QNbJrCD2MBQDXWUDpdGsOY2k=";
+    sha256 = "sha256-c3WoSowF1Z0E9L8DdfOeiluYJzVnzltujE3tKlrLvPQ=";
   };
 
-  vendorHash = "sha256-W5XsUWb3uZGX7RAQQMy67j9LM3KiEl/+XZAGDKTRwd0=";
+  vendorHash = "sha256-2NUB9PLYZr4dnWpuYXkTTII4cRT79zLVU+C9z1GKDxk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/text/nawk/default.nix b/pkgs/tools/text/nawk/default.nix
index e9ae489a02e3..756b5aa12e61 100644
--- a/pkgs/tools/text/nawk/default.nix
+++ b/pkgs/tools/text/nawk/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, bison, buildPackages }:
+{ lib, stdenv, fetchFromGitHub, bison, buildPackages, installShellFiles }:
 
 stdenv.mkDerivation rec {
   pname = "nawk";
-  version = "20220122";
+  version = "20230909";
 
   src = fetchFromGitHub {
     owner = "onetrueawk";
     repo = "awk";
     rev = version;
-    hash = "sha256-W5WkGk4WY3g1qSFjJxFBa8KY1k13oK6WAMg5GH6kKU4=";
+    hash = "sha256-sBJ+ToFkhU5Ei84nqzbS0bUbsa+60iLSz2oeV5+PXEk=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ bison ];
+  nativeBuildInputs = [ bison installShellFiles ];
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
     "HOSTCC=${if stdenv.buildPlatform.isDarwin then "clang" else "cc"}"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     install -Dm755 a.out "$out/bin/nawk"
-    install -Dm644 awk.1 "$out/share/man/man1/nawk.1"
+    installManPage awk.1
     runHook postInstall
   '';
 
diff --git a/pkgs/tools/video/go2rtc/default.nix b/pkgs/tools/video/go2rtc/default.nix
index ec787a0b1daf..9a9da5c49f32 100644
--- a/pkgs/tools/video/go2rtc/default.nix
+++ b/pkgs/tools/video/go2rtc/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "go2rtc";
-  version = "1.6.2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "AlexxIT";
     repo = "go2rtc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LKaVspv9R2N7og+3gb/vZuiWzWt1w+LEQ1Sk737+O7c=";
+    hash = "sha256-o4sxVvDQfJELlA1addsvojkosGMx+/5jrGqPfeYtPUs=";
   };
 
-  vendorHash = "sha256-C2bRSzLp86aMF3UIGJ2G5WXvUaLjyhqzPsQkDSI0qb0=";
+  vendorHash = "sha256-Nv89Fo88bzLrG7PbaGEBM52N81WmGoCiogZNB/FsrcA=";
 
   buildFlagArrays = [
     "-trimpath"
diff --git a/pkgs/tools/video/recyclarr/default.nix b/pkgs/tools/video/recyclarr/default.nix
index f41a1c2c521a..b07e91a50c01 100644
--- a/pkgs/tools/video/recyclarr/default.nix
+++ b/pkgs/tools/video/recyclarr/default.nix
@@ -26,10 +26,10 @@ let
     or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-WtIT5fkkaNDIot1lY5xacYD8XwuaYYnL0ZrJO9EXB3A=";
-    arm64-linux_hash = "sha256-aFLdnGYeKJs0Gp83SqvDg3YO2mGVF5ZIONNQwXMGLj8=";
-    x64-osx_hash = "sha256-eiDO3PdpPk+NXWBKBkpzIHf/1xDe0XByC6NBBfxs55s=";
-    arm64-osx_hash = "sha256-uPv7ZQm6JbgxpylrSi5X5yX0Enrkhq+1sCmFxaghM94=";
+    x64-linux_hash = "sha256-vexo2zx6trv5Q8JifLQG93ZNaAY6ym0ShI81HjBUqTs=";
+    arm64-linux_hash = "sha256-oLtXFkE8b9dxmTwttjJbBSOhxkwInGLpD+WNjDy1ktM=";
+    x64-osx_hash = "sha256-fVIGBuOhwaWttmAGECVm3i4GPKer37mRq6cBz1BcsBc=";
+    arm64-osx_hash = "sha256-eD74AcnRxFgD9PvoPYTBqI0/7MGCqu1I2sq8L1XrmMQ=";
   }."${arch}-${os}_hash";
 
   libPath = {
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "recyclarr";
-  version = "5.2.1";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "https://github.com/recyclarr/recyclarr/releases/download/v${version}/recyclarr-${os}-${arch}.tar.xz";
diff --git a/pkgs/tools/video/svt-av1/default.nix b/pkgs/tools/video/svt-av1/default.nix
index c8620ffee82a..87422a42f0af 100644
--- a/pkgs/tools/video/svt-av1/default.nix
+++ b/pkgs/tools/video/svt-av1/default.nix
@@ -43,7 +43,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = with licenses; [ aom bsd3 ];
     maintainers = with maintainers; [ Madouura ];
     platforms = platforms.unix;
-    # error: use of undeclared identifier 'kCVPixelFormatType_444YpCbCr16BiPlanarVideoRange'
-    broken = stdenv.isAarch64 && stdenv.isDarwin;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0ae4af54161a..8f4d4a7a9f86 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2547,11 +2547,6 @@ with pkgs;
 
   basiliskii = callPackage ../applications/emulators/basiliskii { };
 
-  bochs = callPackage ../applications/emulators/bochs {
-    inherit (darwin) libobjc;
-    wxGTK = wxGTK32;
-  };
-
   box64 = callPackage ../applications/emulators/box64 {
     hello-x86_64 = if stdenv.hostPlatform.isx86_64 then
       hello
@@ -4745,6 +4740,8 @@ with pkgs;
 
   cowsay = callPackage ../tools/misc/cowsay { };
 
+  fw-ectool = callPackage ../os-specific/linux/fw-ectool { };
+
   czkawka = callPackage ../tools/misc/czkawka {
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
@@ -15401,8 +15398,6 @@ with pkgs;
 
   scponly = callPackage ../shells/scponly { };
 
-  tcsh = callPackage ../shells/tcsh { };
-
   rush = callPackage ../shells/rush { };
 
   xonsh = callPackage ../shells/xonsh/wrapper.nix { };
@@ -25742,6 +25737,8 @@ with pkgs;
 
   websocketpp = callPackage ../development/libraries/websocket++ { };
 
+  wfa2-lib = callPackage ../development/libraries/wfa2-lib { };
+
   webrtc-audio-processing_1 = callPackage ../development/libraries/webrtc-audio-processing {
     stdenv = gcc10StdenvCompat;
     abseil-cpp = abseil-cpp.override {
@@ -27418,6 +27415,8 @@ with pkgs;
 
   qcal = callPackage ../tools/networking/qcal/default.nix { };
 
+  qcard = callPackage ../tools/networking/qcard { };
+
   rake = callPackage ../development/tools/build-managers/rake { };
 
   rakkess = callPackage ../development/tools/rakkess { };
@@ -34300,7 +34299,10 @@ with pkgs;
 
   okteto = callPackage ../development/tools/okteto { };
 
-  onlyoffice-bin = callPackage ../applications/office/onlyoffice-bin { };
+  onlyoffice-bin_7_2 = callPackage ../applications/office/onlyoffice-bin/7_2.nix { };
+  onlyoffice-bin_7_4 = callPackage ../applications/office/onlyoffice-bin/7_4.nix { };
+  onlyoffice-bin = onlyoffice-bin_7_2;
+  onlyoffice-bin_latest = onlyoffice-bin_7_4;
 
   onmetal-image = callPackage ../tools/virtualization/onmetal-image { };
 
@@ -36677,8 +36679,7 @@ with pkgs;
 
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
-  windowmaker = callPackage ../applications/window-managers/windowmaker { };
-  dockapps = callPackage ../applications/window-managers/windowmaker/dockapps { };
+  dockapps = callPackage ../by-name/wi/windowmaker/dockapps { };
 
   wily = callPackage ../applications/editors/wily { };
 
@@ -38577,6 +38578,8 @@ with pkgs;
 
   steamback = python311.pkgs.callPackage ../tools/games/steamback { };
 
+  steamguard-cli = callPackage ../tools/security/steamguard-cli { };
+
   protontricks = python3Packages.callPackage ../tools/package-management/protontricks {
     inherit winetricks steam-run yad;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0ec2a6fb11da..30e7aaff455a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1901,6 +1901,8 @@ self: super: with self; {
 
   check-manifest = callPackage ../development/python-modules/check-manifest { };
 
+  checkdmarc = callPackage ../development/python-modules/checkdmarc { };
+
   cheetah3 = callPackage ../development/python-modules/cheetah3 { };
 
   cheroot = callPackage ../development/python-modules/cheroot { };
@@ -2717,6 +2719,8 @@ self: super: with self; {
 
   diffimg = callPackage ../development/python-modules/diffimg { };
 
+  diffsync = callPackage ../development/python-modules/diffsync { };
+
   digital-ocean = callPackage ../development/python-modules/digitalocean { };
 
   digi-xbee = callPackage ../development/python-modules/digi-xbee { };
@@ -6124,6 +6128,8 @@ self: super: with self; {
     inherit (self) python libxml2;
   })).py;
 
+  liccheck = callPackage ../development/python-modules/liccheck { };
+
   license-expression = callPackage ../development/python-modules/license-expression { };
 
   lief = (toPythonModule (pkgs.lief.override {
@@ -7372,6 +7378,8 @@ self: super: with self; {
 
   python-nvd3 = callPackage ../development/python-modules/python-nvd3 { };
 
+  python-yate = callPackage ../development/python-modules/python-yate { };
+
   python-youtube = callPackage ../development/python-modules/python-youtube { };
 
   py-deprecate = callPackage ../development/python-modules/py-deprecate { };
@@ -8222,6 +8230,8 @@ self: super: with self; {
 
   pyflick = callPackage ../development/python-modules/pyflick { };
 
+  pyfluidsynth = callPackage ../development/python-modules/pyfluidsynth { };
+
   pyfreedompro = callPackage ../development/python-modules/pyfreedompro { };
 
   pygments-style-github = callPackage ../development/python-modules/pygments-style-github { };
@@ -8686,6 +8696,8 @@ self: super: with self; {
 
   pulp = callPackage ../development/python-modules/pulp { };
 
+  pulsectl-asyncio = callPackage ../development/python-modules/pulsectl-asyncio { };
+
   pulsectl = callPackage ../development/python-modules/pulsectl { };
 
   pure-cdb = callPackage ../development/python-modules/pure-cdb { };
@@ -9354,6 +9366,8 @@ self: super: with self; {
 
   pyld = callPackage ../development/python-modules/pyld { };
 
+  pyleri = callPackage ../development/python-modules/pyleri { };
+
   pylev = callPackage ../development/python-modules/pylev { };
 
   pylgnetcast = callPackage ../development/python-modules/pylgnetcast { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 6ae4443678a8..540610bccbd5 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1dbzp5lk7canhdrs8n8cap3mwnanfn6i7yn76ba8kzn0h1cx077a";
+      sha256 = "117vxic67jnw6q637kmsb3ryj0x485295pz9a9y4z8xn9bdlsl0z";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail" "net-imap" "net-pop" "net-smtp"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09640w7sqmxv1gxsw9gfnfdl95qgm90s38n49jyqyqavxnwgnbbs";
+      sha256 = "1r8ldj2giaz8cn49qkdqn5zc29gbsr5ky4fg6r7ali0yh1xh684l";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "net-imap" "net-pop" "net-smtp" "rails-dom-testing"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15ni57icsw1ilz5srlasff4h31h2ckgmxbdd8jnbniscvz4x2sd0";
+      sha256 = "0w6gvj7ybniq89834hqww9rj2xypz9l91f8niwaws2yq1qklymr2";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "150sjsk12vzj9aswjy3cz124l8n8sn52bhd0wwly73rwc1a750sg";
+      sha256 = "1l319p0gipfgq8bp8dvbv97qqb72rad9zcqn5snhgv20cmpqr69b";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "globalid" "nokogiri"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m6bdgspimlsakvi2dwndlf6i9wc1iwcjcm2nmpdfn2jj836fprm";
+      sha256 = "0i47r3n2m8qm002gx7c0lx1pv15pr2zy57dm8j38x960rsb655pp";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nn21k5psxdv2fkwxs679lr0b8n1nzli2ks343cx4azn6snp8b8a";
+      sha256 = "0xnpdwj1d8m6c2d90jp9cs50ggiz0jj02ls2h9lg68k4k8mnjbd2";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s5r5z9jm57jjabh8w2823rpjd1agn8z2rlqgyyn4s9pbbhgalzy";
+      sha256 = "1cn1ic7ml75jm0c10s7cm5mvcgfnafj0kjvvjavpjcxgz6lxcqyb";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rspbw4yxx9fh2wyl2wvgwadwapfyx7j9zlirpd4pmk31wkhl4hf";
+      sha256 = "004w8zaz2g3y6lnrsvlcmljll0m3ndqpgwf0wfscgq6iysibiglm";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ygg145wxlgm12b1x5r0rsk2aa6i2wjz7bgb21j8vmyqyfl272cy";
+      sha256 = "04wavps80q3pvhvfbmi4gs102y1p6mxbg8xylzvib35b6m92adpj";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   activestorage = {
     dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel" "mini_mime"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gaxpqw4mv7xrk1iaw9jspf4m201mkmchc0c22ax3snm3v6jg2qv";
+      sha256 = "0d6vm6alsp0g6f3548b615zxbz8l2wrmaikwgsf8kv11wf6swb4c";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
@@ -115,10 +115,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wzbnv3hns0yiwbgh1m3q5j0d7b0k52nlpwirhxyv3l0ycmljfr9";
+      sha256 = "188kbwkn1lbhz40ala8ykp20jzqphgc68g3d8flin8cqa2xid0s5";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -168,10 +168,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r3g92r9dnvbwklm8dx6w3ym8xhz90a2hs2sdarwhhydfyzxdcrj";
+      sha256 = "1rqhn05qvfzr7d3d4kv4z8ssw04ggg28gfnq92adpxxvkl6wqkms";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   atomos = {
     groups = ["default"];
@@ -233,6 +233,16 @@
     };
     version = "0.2.1";
   };
+  bigdecimal = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07y615s8yldk3k13lmkhpk1k190lcqvmxmnjwgh4bzjan9xrc36y";
+      type = "gem";
+    };
+    version = "3.1.4";
+  };
   bindata = {
     groups = ["default"];
     platforms = [];
@@ -280,10 +290,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vbq8gprb99anlxijc7hwamfvshd6w1k6kwwg5gs2c674nln1hqf";
+      sha256 = "1jk90pjw4a0fl8ridv63h2w5c5xa2w9ajbq7z02ii70qi2z9j4rm";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   camping = {
     dependencies = ["mab" "rack"];
@@ -996,10 +1006,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08r6qgbpkxxsihjmlspk3l1sr69q5hx35p1l4wp7rmkbzys89867";
+      sha256 = "0mbkyyadz9vw7mzixi9dks6i6iw033yn2hzwfvnfdvgqq6ywqs4g";
       type = "gem";
     };
-    version = "0.100.0";
+    version = "0.102.0";
   };
   execjs = {
     groups = ["default"];
@@ -1153,10 +1163,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qr0dn4p3nrqnb8qjdlnsfhz80viv4fn86a450imabr76mr88fs3";
+      sha256 = "0hmfbddsjj7x5i2aj0i8l9jhp19lrcm4d6q4xqm7gyjnrs98v5q5";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   gemoji = {
     groups = ["default"];
@@ -1184,10 +1194,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jl1ng4db6iaa6yddvp69c61r7483kwvcr57hj3qm9pddkgf0bp0";
+      sha256 = "1ij82r1b1190vry1xwqh7nz4qasdh2fppmx93nrv1jam4hy0gm7k";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   git = {
     dependencies = ["addressable" "rchardet"];
@@ -1238,10 +1248,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00r3357m7fdvhsy1xi93bvvih4jgwf8lbg8dwrz2mggi1v6nh6n4";
+      sha256 = "05qg16pxnzshgzgfky83b948r9d03lachq2clm8qrsj4c202smq3";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   globalid = {
     dependencies = ["activesupport"];
@@ -1249,10 +1259,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kqm5ndzaybpnpxqiqkc41k4ksyxl41ln8qqr6kb130cdxsf2dxk";
+      sha256 = "1sbw6b66r7cwdx3jhs46s4lr991969hvigkjpbdl7y3i31qpdgvh";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   gobject-introspection = {
     dependencies = ["glib2"];
@@ -1260,10 +1270,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00lai12z92y6kidsrwnw0d386bwyzjrw0z07ifjxqn5zpyasgvkb";
+      sha256 = "03n47jlyqygxyc5fsf39szfswlcnnmmwqly12cqjqfmk6skvfhc5";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   gpgme = {
     dependencies = ["mini_portile2"];
@@ -1271,10 +1281,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qn87vxdsaq1szcvq39rnz38cgqllncdxmiyghnbzl7x5aah8sbw";
+      sha256 = "010wr6nnifi952bx4v5c49q25yx1g8lhib5wiv2sg7bip3yvlyy8";
       type = "gem";
     };
-    version = "2.0.22";
+    version = "2.0.23";
   };
   gtk2 = {
     groups = ["default"];
@@ -1292,10 +1302,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1vcr5wcvfbsq91302playk3i98wdisspkybcmajl04agv4k8xr68";
+      sha256 = "154svzqlkdq7gslv3p8mfih28gbw4gsj4pd8wr1wpwz6nyzmhh8m";
       type = "gem";
     };
-    version = "6.1.1";
+    version = "6.1.2";
   };
   hashie = {
     groups = ["default"];
@@ -2209,10 +2219,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1s95nyppk5wrpfgqrzf6f00g7nk0662zmxm4mr2vbdbl83q3k72x";
+      sha256 = "0q8d881k1b3rbsfcdi3fx0b5vpdr5wcrhn88r2d9j7zjdkxp5mw5";
       type = "gem";
     };
-    version = "3.5.0";
+    version = "3.5.1";
   };
   mime-types-data = {
     groups = ["default"];
@@ -2270,10 +2280,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jnpsbb2dbcs95p4is4431l2pw1l5pn7dfg3vkgb4ga464j0c5l6";
+      sha256 = "0bkmfi9mb49m0fkdhl2g38i3xxa02d411gg0m8x0gvbwfmmg5ym3";
       type = "gem";
     };
-    version = "5.19.0";
+    version = "5.20.0";
   };
   molinillo = {
     groups = ["default"];
@@ -2457,10 +2467,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jw8a20a9k05fpz3q24im19b97idss3179z76yn5scc5b8lk2rl7";
+      sha256 = "0k9w2z0953mnjrsji74cshqqp08q7m1r6zhadw1w0g34xzjh3a74";
       type = "gem";
     };
-    version = "1.15.3";
+    version = "1.15.4";
   };
   octokit = {
     dependencies = ["faraday" "sawyer"];
@@ -2554,10 +2564,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1707vylw6yix9q92bpnvn5dflnywx5bh69awyirvn4g39p2yjc2b";
+      sha256 = "0n41ywk853l3arii0ksnbwhzncy16y6n8kfxvd548433gx2355qw";
       type = "gem";
     };
-    version = "4.1.8";
+    version = "4.2.0";
   };
   parallel = {
     groups = ["default"];
@@ -2637,20 +2647,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zcvxmfa8hxkhpp59fhxyxy1arp70f11zi1jh9c7bsdfspifb7kb";
+      sha256 = "0pfj771p5a29yyyw58qacks464sl86d5m3jxjl5rlqqw2m3v5xq4";
       type = "gem";
     };
-    version = "1.5.3";
+    version = "1.5.4";
   };
   pkg-config = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i9skw2yry57nyphzvhrvw2k1lan0ysfpf157qd7s7apsscdzc7w";
+      sha256 = "184c3fb62qafc4wpar63w1ig5g7qh22a632slzrpq37zjjwpszqd";
       type = "gem";
     };
-    version = "1.5.2";
+    version = "1.5.5";
   };
   polyglot = {
     groups = ["default"];
@@ -2732,10 +2742,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1v7fmv0n4bhdcwh60dgza44iqai5pg34f5pzm4vh4i5fwx7mpqxh";
+      sha256 = "1x4dwx2shx0p7lsms97r85r7ji7zv57bjy3i1kmcpxc8bxvrr67c";
       type = "gem";
     };
-    version = "6.3.0";
+    version = "6.3.1";
   };
   pwntools = {
     dependencies = ["crabstone" "dentaku" "elftools" "keystone-engine" "method_source" "one_gadget" "rainbow" "ruby2ruby" "rubyserial"];
@@ -2796,10 +2806,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06rd03bpdg29gql5xb6ijdq9br5060v4bykaz739zx2qm8xnjs9j";
+      sha256 = "0rsqin156dawz7gzpy1ijs02afqcr4704vqj56s6yxng3a9ayhwf";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "minitest" "nokogiri"];
@@ -2829,10 +2839,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0in2b84qqmfnigx0li9bgi6l4knmgbj3a29fzm1zzb5jnv4r1gbr";
+      sha256 = "0sfc16zrcn4jgf5xczb08n6prhmqqgg9f0b4mn73zlzg6cwmqchj";
       type = "gem";
     };
-    version = "7.0.7";
+    version = "7.0.8";
   };
   rainbow = {
     groups = ["default"];
@@ -2964,10 +2974,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fbs2fbl1g5lra43qk6rawbvynj2qgdzyx1gnjsjcxbl8247bahl";
+      sha256 = "0n3nl3znncrnv2gi4byqhc79jvv50b0vkf7ci7w6a90qn9fvwxxm";
       type = "gem";
     };
-    version = "0.15.0";
+    version = "0.17.0";
   };
   redis-rack = {
     dependencies = ["rack" "redis-store"];
@@ -3124,10 +3134,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ig23w64f9y1gi6l4pv69m0nfhn3nnr3q4s81br9vl1b1z02n5cn";
+      sha256 = "1hr8g9pqw3w87a83kqcxpayrx4jmsziharrg4vqw0gr9kksx2dfv";
       type = "gem";
     };
-    version = "1.56.0";
+    version = "1.56.2";
   };
   rubocop-ast = {
     dependencies = ["parser"];
@@ -3146,10 +3156,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bp02784v0qm8qcswi169s0ar6216rwk516v3idzpbxznpqp97ac";
+      sha256 = "1v3a2g3wk3aqa0k0zzla10qkxlc625zkj3yf4zcsybs86r5bm4xn";
       type = "gem";
     };
-    version = "1.18.0";
+    version = "1.19.0";
   };
   ruby-graphviz = {
     dependencies = ["rexml"];
@@ -3184,15 +3194,15 @@
     version = "0.8.0";
   };
   ruby-lsp = {
-    dependencies = ["language_server-protocol" "sorbet-runtime" "syntax_tree"];
+    dependencies = ["language_server-protocol" "sorbet-runtime" "syntax_tree" "yarp"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xzl5na2n3g47w9arf0cj0dpdlxssd0bhbsg5h12kpa8lp24ki1y";
+      sha256 = "1310xzjad432d18w882q6j9xgwim6fslgrmh78v49xc8py7rszyk";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.9.4";
   };
   ruby-lxc = {
     groups = ["default"];
@@ -3303,10 +3313,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "016bawsahkhxx7p8azxirpl7y2y7i8a027pj8910gwf6ipg329in";
+      sha256 = "02m9zksfy3dwzhbv56xq2wwmlghca5209hdg895pi2x2d2sbkahi";
       type = "gem";
     };
-    version = "1.6.3";
+    version = "1.7.1";
   };
   safe_yaml = {
     groups = ["default"];
@@ -3384,14 +3394,15 @@
     version = "0.19.1";
   };
   sequel = {
+    dependencies = ["bigdecimal"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jan1hyrsxi964caqm81w364fmczz4xrbd2fi9ciw1hmyb9cm7m4";
+      sha256 = "12vybpvczsd7sybvz44h35n5yzwsbp1d3qn743qw5gs6p362f2av";
       type = "gem";
     };
-    version = "5.71.0";
+    version = "5.72.0";
   };
   sequel_pg = {
     dependencies = ["pg" "sequel"];
@@ -3524,10 +3535,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1abdrhb4sf5wwlvli87nh5jiy13dy2szv448h6a4bzyrg3nf47fx";
+      sha256 = "1dz1h8sjb1rv52673ji0ji95zfy7vfbl6id52p2f3046xk0snjib";
       type = "gem";
     };
-    version = "0.5.10957";
+    version = "0.5.11011";
   };
   sqlite3 = {
     dependencies = ["mini_portile2"];
@@ -3535,10 +3546,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h95kr5529qv786mfk8r2jjdsdi6v7v3k3dpz69mrcc9i0vpdd37";
+      sha256 = "1kpxfxpjv5h1is0s9zj7d6grh4bsvr0cf6b976mpamdrc39gw9pv";
       type = "gem";
     };
-    version = "1.6.3";
+    version = "1.6.5";
   };
   syntax_tree = {
     dependencies = ["prettier_print"];
@@ -3618,10 +3629,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1r3k8x3vfaa6wnz8mhpn10938bzmfj489zc18q73xpsb469v0nv9";
+      sha256 = "17cwh2ivvkfzv7m0m3rpyagwqz20mcincvjvz7cg3g21xzannqys";
       type = "gem";
     };
-    version = "0.18.1";
+    version = "0.19.0";
   };
   tilt = {
     groups = ["default"];
@@ -3842,6 +3853,16 @@
     };
     version = "0.9.34";
   };
+  yarp = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1bz9lkbcj0q1njggin5g9gi4v15x8qj3dma5vmwibfnf5mzznvx5";
+      type = "gem";
+    };
+    version = "0.10.0";
+  };
   zeitwerk = {
     groups = ["default"];
     platforms = [];