diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 29ceab883af8..b2cded239a7b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13576,6 +13576,15 @@
       fingerprint = "1248 D3E1 1D11 4A85 75C9  8934 6794 D45A 488C 2EDE";
     }];
   };
+  momeemt = {
+    name = "Mutsuha Asada";
+    email = "me@momee.mt";
+    github = "momeemt";
+    githubId = 43488453;
+    keys = [{
+      fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6";
+    }];
+  };
   monaaraj = {
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index faf538e610e5..fc9b39b8fb8d 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -53,6 +53,10 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - `system.etc.overlay.enable` option was added. If enabled, `/etc` is
   mounted via an overlayfs instead of being created by a custom perl script.
 
+- For each supporting version of the Linux kernel firmware blobs and kernel modules
+  are compressed with zstd. For firmware blobs this means an increase of 4.4% in size, however
+  a significantly higher decompression speed.
+
 - NixOS AMIs are now uploaded regularly to a new AWS Account.
   Instructions on how to use them can be found on <https://nixos.github.io/amis>.
   We are working on integration the data into the NixOS homepage.
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 3db661644281..62603d20e2d3 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -167,10 +167,16 @@ let
       mv etc/udev/hwdb.bin $out
     '';
 
-  compressFirmware = firmware: if (config.boot.kernelPackages.kernelAtLeast "5.3" && (firmware.compressFirmware or true)) then
-    pkgs.compressFirmwareXz firmware
-  else
-    id firmware;
+  compressFirmware = firmware:
+    let
+      inherit (config.boot.kernelPackages) kernelAtLeast;
+    in
+      if ! (firmware.compressFirmware or true) then
+        firmware
+      else
+        if kernelAtLeast "5.19" then pkgs.compressFirmwareZstd firmware
+        else if kernelAtLeast "5.3" then pkgs.compressFirmwareXz firmware
+        else firmware;
 
   # Udev has a 512-character limit for ENV{PATH}, so create a symlink
   # tree to work around this.
diff --git a/pkgs/applications/misc/clight/clight-gui.nix b/pkgs/applications/misc/clight/clight-gui.nix
new file mode 100644
index 000000000000..da7dd77deeaa
--- /dev/null
+++ b/pkgs/applications/misc/clight/clight-gui.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, qtbase
+, qtcharts
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clight-gui";
+  version = "unstable-2023-02-21";
+
+  src = fetchFromGitHub {
+    owner = "nullobsi";
+    repo = "clight-gui";
+    rev = "29e7216bfcc68135350a695ce446134bcb0463a6";
+    hash = "sha256-U4vaMwnVDZnYLc+K3/yD81Q1vyBL8uSrrhOHbjbox5U=";
+  };
+
+  buildInputs = [ qtbase qtcharts ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  sourceRoot = "${src.name}/src";
+
+  meta = with lib; {
+    description = "Qt GUI for clight";
+    homepage = "https://github.com/nullobsi/clight-gui";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nickhu ];
+    mainProgram = "clight-gui";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/misc/elogind/default.nix b/pkgs/applications/misc/elogind/default.nix
index 56f8be698f32..a8b71f34ede5 100644
--- a/pkgs/applications/misc/elogind/default.nix
+++ b/pkgs/applications/misc/elogind/default.nix
@@ -12,7 +12,7 @@
 , udev
 , eudev
 , libxslt
-, python3
+, python3Packages
 , docbook5
 , docbook_xsl
 , docbook_xsl_ns
@@ -47,11 +47,13 @@ stdenv.mkDerivation rec {
     gettext
     libxslt.bin # xsltproc
     docbook5 docbook_xsl docbook_xsl_ns docbook_xml_dtd_42 docbook_xml_dtd_45 # needed for docbook without Internet
-    (python3.withPackages (p: with p; [ lxml ]))  # fixes: man/meson.build:111:0: ERROR: Could not execute command "/build/source/tools/xml_helper.py".
+
+    # fixes: man/meson.build:111:0: ERROR: Could not execute command "/build/source/tools/xml_helper.py".
+    python3Packages.python
+    python3Packages.lxml
   ];
 
-  buildInputs =
-    if enableSystemd then [ udev ] else [ eudev ];
+  buildInputs = [ libcap ] ++ (if enableSystemd then [ udev ] else [ eudev ]);
 
   # Inspired by the systemd `preConfigure`.
   # Conceptually we should patch all files required during the build, but not scripts
diff --git a/pkgs/applications/misc/gradience/default.nix b/pkgs/applications/misc/gradience/default.nix
index fcb7d10c0162..3ddbe86cd78b 100644
--- a/pkgs/applications/misc/gradience/default.nix
+++ b/pkgs/applications/misc/gradience/default.nix
@@ -67,6 +67,7 @@ python3Packages.buildPythonApplication rec {
     pygobject3
     svglib
     yapsy
+    packaging
   ];
 
   preFixup = ''
diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 6e97bad8f913..9e7c983d4801 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-pHyIL5Jmldsa0ZNMiYpBD+9zxPv8Blg23nnWD2YmHMI=";
+    sha256 = "sha256-L03r4PHCu+jsUC5vVSG77SR2ak/AsuVAhTd7P1WibAk=";
   };
 
-  cargoHash = "sha256-N1Cv89njL9QCIs3HclcjsqgSUSMEckis8zyVqepeW70=";
+  cargoHash = "sha256-5UxbZZdVioy1OZCbE6qESGKVnVT6TS4VHzsKlQ8XP2c=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";
diff --git a/pkgs/applications/misc/resp-app/default.nix b/pkgs/applications/misc/resp-app/default.nix
index 9748ca63c281..efd279189351 100644
--- a/pkgs/applications/misc/resp-app/default.nix
+++ b/pkgs/applications/misc/resp-app/default.nix
@@ -77,6 +77,7 @@ mkDerivation rec {
       --replace '/opt/resp_app' "${placeholder "out"}" \
       --replace 'target.path = $$LINUX_INSTALL_PATH' 'target.path = $$LINUX_INSTALL_PATH/bin' \
       --replace '/usr/' "$out/"
+    rm -r 3rdparty/snappy
   '';
 
   qmakeFlags = [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index f6f435d4aba4..78a558177406 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-RGOChK4JhrFUgVY/5YqgE0KFLRl6a7X2llw1ZfhiPXY=";
+      hash_darwin = "sha256-4MZwD2jgjOrBTtkjxW0XH+lZfP8wj7Z6eg7LwFziCPU=";
       hash_darwin_aarch64 =
-        "sha256-K1jFXmWtXrS43UJg2mQ39Kae6tv7E9Fxm6LUWg+uwLo=";
-      hash_linux = "sha256-xwaRNh7sllyNaq8+aLAZDQ3uDg06cu3KYqc02LWPSyw=";
-      version = "124.0.6367.91";
+        "sha256-P9qi8rR8DW+WOT+ev2EgA93StnGrBiIHu2UbkEhS+0M=";
+      hash_linux = "sha256-eudgRu3OMuTBTeX8zrm6ShgmjcsNhzaBYEAP/4n1SJk=";
+      version = "124.0.6367.155";
     };
     deps = {
       gn = {
@@ -15,9 +15,9 @@
         version = "2024-03-14";
       };
     };
-    hash = "sha256-+r/48dxipSAo74v1deMuKalW+Hj85hCun63ZcgLYDLk=";
-    hash_deb_amd64 = "sha256-H3bv6WiVBl4j38ROZ80+SD9UO9ok+xxcKFxDd9yjWNY=";
-    version = "124.0.6367.118";
+    hash = "sha256-Qv1xYofY4Tgj+WT1a8ehOo7R52CwZz2vCK9MDSnjmsg=";
+    hash_deb_amd64 = "sha256-lFG5l3K2Yo1BYbXS9bK+9gWx6JxFrPxpT+zI7dBXQ6E=";
+    version = "124.0.6367.155";
   };
   ungoogled-chromium = {
     deps = {
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
deleted file mode 100644
index 5c3f607e5c0e..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
+++ /dev/null
@@ -1,19 +0,0 @@
---disable-sound
---enable-video
---enable-ext-sound
---disable-speex-aec
---disable-g711-codec
---disable-l16-codec
---disable-gsm-codec
---disable-g722-codec
---disable-g7221-codec
---disable-speex-codec
---disable-ilbc-codec
---disable-opencore-amr
---disable-silk
---disable-sdl
---disable-ffmpeg
---disable-v4l2
---disable-openh264
---disable-resample
---disable-libwebrtc
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
deleted file mode 100644
index d1292afe3a29..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
+++ /dev/null
@@ -1 +0,0 @@
---enable-epoll
diff --git a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_patches b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_patches
deleted file mode 100644
index 5b9579f8f94e..000000000000
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_patches
+++ /dev/null
@@ -1 +0,0 @@
-0009-add-config-site.patch
diff --git a/pkgs/applications/networking/instant-messengers/jami/default.nix b/pkgs/applications/networking/instant-messengers/jami/default.nix
index 91676d45a04c..6a6925d66627 100644
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@@ -35,6 +35,7 @@
 
   # for client
 , cmake
+, git
 , networkmanager # for libnm
 , python3
 , qttools # for translations
@@ -61,57 +62,80 @@
 , opendht
 }:
 
-let
-  readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
-in
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20231201.0";
+  version = "20240430.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-A38JwjqdQVy03d738p2tpTFA6EWRSPNiesS5wZfti7Y=";
+    hash = "sha256-v7558m2h3RqvLLhf3BdYO9LKCFKuMTtPIXgH6OXiiY4=";
     fetchSubmodules = true;
   };
 
-  pjsip-jami = pjsip.overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/pjproject/";
-    in
-    rec {
-      version = "311bd018fc07aaf62d4c2d2494e08b5ee97e6846";
+  pjsip-jami = pjsip.overrideAttrs (old: rec {
+    version = "797f1a38cc1066acc4adc9561aa1288afabe72d5";
 
-      src = fetchFromGitHub {
-        owner = "savoirfairelinux";
-        repo = "pjproject";
-        rev = version;
-        hash = "sha256-pZiOSOUxAXzMY4c1/AyKcwa7nyIJC/ZVOqDg9/QO/Nk=";
-      };
+    src = fetchFromGitHub {
+      owner = "savoirfairelinux";
+      repo = "pjproject";
+      rev = version;
+      hash = "sha256-lTDbJF09R2G+EIkMj1YyKa4XokH9LlcIG+RhRJhzUes=";
+    };
 
-      patches = (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches));
+    configureFlags = [
+      "--disable-sound"
+      "--enable-video"
+      "--enable-ext-sound"
+      "--disable-speex-aec"
+      "--disable-g711-codec"
+      "--disable-l16-codec"
+      "--disable-gsm-codec"
+      "--disable-g722-codec"
+      "--disable-g7221-codec"
+      "--disable-speex-codec"
+      "--disable-ilbc-codec"
+      "--disable-opencore-amr"
+      "--disable-silk"
+      "--disable-sdl"
+      "--disable-ffmpeg"
+      "--disable-v4l2"
+      "--disable-openh264"
+      "--disable-resample"
+      "--disable-libwebrtc"
+      "--with-gnutls=yes"
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      "--enable-epoll"
+    ];
 
-      configureFlags = (readLinesToList ./config/pjsip_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/pjsip_args_linux);
-    });
+    buildInputs = old.buildInputs ++ [ gnutls ];
+  });
 
-  opendht-jami = opendht.override {
+  opendht-jami = (opendht.overrideAttrs {
+    src = fetchFromGitHub {
+      owner = "savoirfairelinux";
+      repo = "opendht";
+      rev = "f2cee8e9ce24746caa7dee1847829c526d340284";
+      hash = "sha256-ZnIrlybF3MCiXxxv80tRzCJ5CJ54S42prGUjq1suJNA=";
+    };
+  }).override {
     enableProxyServerAndClient = true;
     enablePushNotifications = true;
   };
 
   dhtnet = stdenv.mkDerivation {
     pname = "dhtnet";
-    version = "unstable-2023-11-23";
+    version = "unstable-2022-04-26";
 
     src = fetchFromGitLab {
       domain = "git.jami.net";
       owner = "savoirfairelinux";
       repo = "dhtnet";
-      rev = "b1bcdecbac2a41de3941ef5a34faa6fbe4472535";
-      hash = "sha256-EucSsUuHXbVqr7drrTLK0f+WZT2k9Tx/LV+IBldTQO8=";
+      rev = "d7976982d24867c6faaf8103504ec8a10d932fa0";
+      hash = "sha256-vazFDMIu/3AWeOz0LZhZD9NFO8cd5AK41zBpqpQrqnc=";
     };
 
     nativeBuildInputs = [
@@ -130,6 +154,7 @@ stdenv.mkDerivation rec {
       opendht-jami
       openssl
       pjsip-jami
+      python3
       restinio
     ];
 
@@ -193,6 +218,20 @@ stdenv.mkDerivation rec {
     enableParallelBuilding = true;
   };
 
+  qwindowkit = fetchFromGitHub {
+    owner = "stdware";
+    repo = "qwindowkit";
+    rev = "79b1f3110754f9c21af2d7dacbd07b1a9dbaf6ef";
+    hash = "sha256-iZfmv3ADVjHf47HPK/FdrfeAzrXbxbjH3H5MFVg/ZWE=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    sed -i -e '/GIT_REPOSITORY/,+1c SOURCE_DIR ''${CMAKE_CURRENT_SOURCE_DIR}/qwindowkit' extras/build/cmake/contrib_tools.cmake
+    sed -i -e 's/if(DISTRO_NEEDS_QMSETUP_PATCH)/if(TRUE)/' CMakeLists.txt
+    cp -R --no-preserve=mode,ownership ${qwindowkit} qwindowkit
+  '';
+
   preConfigure = ''
     echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
     # Currently the daemon is still built seperately but jami expects it in CMAKE_INSTALL_PREFIX
@@ -208,6 +247,7 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
     pkg-config
     cmake
+    git
     python3
     qttools
   ];
diff --git a/pkgs/build-support/dlang/builddubpackage/default.nix b/pkgs/build-support/dlang/builddubpackage/default.nix
index 9295445b0f7c..31454d5cd69b 100644
--- a/pkgs/build-support/dlang/builddubpackage/default.nix
+++ b/pkgs/build-support/dlang/builddubpackage/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchgit,
   linkFarm,
   dub,
   ldc,
@@ -43,11 +44,27 @@ let
       };
     };
 
-  lockJson = if lib.isPath dubLock then lib.importJSON dubLock else dubLock;
+  makeGitDep =
+    {
+      pname,
+      version,
+      repository,
+      sha256,
+    }:
+    {
+      inherit pname version;
+      src = fetchgit {
+        url = repository;
+        rev = version;
+        inherit sha256;
+      };
+    };
 
-  lockedDeps = lib.mapAttrsToList (
-    pname: { version, sha256 }: makeDubDep { inherit pname version sha256; }
-  ) lockJson.dependencies;
+  lockJson = if lib.isPath dubLock then lib.importJSON dubLock else dubLock;
+  depsRaw = lib.mapAttrsToList (pname: args: { inherit pname; } // args) lockJson.dependencies;
+
+  dubDeps = map makeDubDep (lib.filter (args: !(args ? repository)) depsRaw);
+  gitDeps = map makeGitDep (lib.filter (args: args ? repository) depsRaw);
 
   # a directory with multiple single element registries
   # one big directory with all .zip files leads to version parsing errors
@@ -56,7 +73,7 @@ let
     map (dep: {
       name = "${dep.pname}/${dep.pname}-${dep.version}.zip";
       path = dep.src;
-    }) lockedDeps
+    }) dubDeps
   );
 
   combinedFlags = "--skip-registry=all --compiler=${lib.getExe compiler} ${toString dubFlags}";
@@ -79,12 +96,18 @@ stdenv.mkDerivation (
         runHook preConfigure
 
         export DUB_HOME="$NIX_BUILD_TOP/.dub"
-        mkdir -p $DUB_HOME
+        mkdir -p "$DUB_HOME"
 
-        # register dependencies
+        # register dub dependencies
         ${lib.concatMapStringsSep "\n" (dep: ''
           dub fetch ${dep.pname}@${dep.version} --cache=user --skip-registry=standard --registry=file://${dubRegistryBase}/${dep.pname}
-        '') lockedDeps}
+        '') dubDeps}
+
+        # register git dependencies
+        ${lib.concatMapStringsSep "\n" (dep: ''
+          mkdir -p "$DUB_HOME/packages/${dep.pname}/${dep.version}"
+          cp -r --no-preserve=all ${dep.src} "$DUB_HOME/packages/${dep.pname}/${dep.version}/${dep.pname}"
+        '') gitDeps}
 
         runHook postConfigure
       '';
diff --git a/pkgs/build-support/dlang/dub-to-nix/default.nix b/pkgs/build-support/dlang/dub-to-nix/default.nix
index 53a2e99c18df..87db7eed0933 100644
--- a/pkgs/build-support/dlang/dub-to-nix/default.nix
+++ b/pkgs/build-support/dlang/dub-to-nix/default.nix
@@ -4,8 +4,15 @@
   makeWrapper,
   python3,
   nix,
+  nix-prefetch-git,
 }:
 
+let
+  binPath = lib.makeBinPath [
+    nix
+    nix-prefetch-git
+  ];
+in
 runCommand "dub-to-nix"
   {
     nativeBuildInputs = [ makeWrapper ];
@@ -15,5 +22,5 @@ runCommand "dub-to-nix"
     install -Dm755 ${./dub-to-nix.py} "$out/bin/dub-to-nix"
     patchShebangs "$out/bin/dub-to-nix"
     wrapProgram "$out/bin/dub-to-nix" \
-        --prefix PATH : ${lib.makeBinPath [ nix ]}
+        --prefix PATH : ${binPath}
   ''
diff --git a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
index 48a9f241348a..fbb51960ad7b 100644
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@@ -4,10 +4,13 @@ import sys
 import json
 import os
 import subprocess
+import string
+
 
 def eprint(text: str):
     print(text, file=sys.stderr)
 
+
 if not os.path.exists("dub.selections.json"):
     eprint("The file `dub.selections.json` does not exist in the current working directory")
     eprint("run `dub upgrade --annotate` to generate it")
@@ -16,24 +19,53 @@ if not os.path.exists("dub.selections.json"):
 with open("dub.selections.json") as f:
     selectionsJson = json.load(f)
 
-versionDict: dict[str, str] = selectionsJson["versions"]
+depsDict: dict = selectionsJson["versions"]
 
-for pname in versionDict:
-    version = versionDict[pname]
+# For each dependency expand non-expanded version into a dict with a "version" key
+depsDict = {pname: (versionOrDepDict if isinstance(versionOrDepDict, dict) else {"version": versionOrDepDict}) for (pname, versionOrDepDict) in depsDict.items()}
+
+# Don't process path-type selections
+depsDict = {pname: depDict for (pname, depDict) in depsDict.items() if "path" not in depDict}
+
+# Pre-validate selections before trying to fetch
+for pname in depsDict:
+    depDict = depsDict[pname]
+    version = depDict["version"]
     if version.startswith("~"):
-        eprint(f'Package "{pname}" has a branch-type version "{version}", which doesn\'t point to a fixed version')
-        eprint("You can resolve it by manually changing the required version to a fixed one inside `dub.selections.json`")
-        eprint("When packaging, you might need to create a patch for `dub.sdl` or `dub.json` to accept the changed version")
+        eprint(f'Expected version of "{pname}" to be non-branch type')
+        eprint(f'Found: "{version}"')
+        eprint("Please specify a non-branch version inside `dub.selections.json`")
+        eprint("When packaging, you might also need to patch the version value in the appropriate places (`dub.selections.json`, dub.sdl`, `dub.json`)")
         sys.exit(1)
+    if "repository" in depDict:
+        repository = depDict["repository"]
+        if not repository.startswith("git+"):
+            eprint(f'Expected repository field of "{pname}" to begin with "git+"')
+            eprint(f'Found: "{repository}"')
+            sys.exit(1)
+        if (len(version) < 7 or len(version) > 40 or not all(c in string.hexdigits for c in version)):
+            eprint(f'Expected version field of "{pname}" to begin be a valid git revision')
+            eprint(f'Found: "{version}"')
+            sys.exit(1)
 
-lockedDependenciesDict: dict[str, dict[str, str]] = {}
+lockedDepsDict: dict[str, dict[str, str]] = {}
 
-for pname in versionDict:
-    version = versionDict[pname]
-    eprint(f"Fetching {pname}@{version}")
-    url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
-    command = ["nix-prefetch-url", "--type", "sha256", url]
-    sha256 = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout.rstrip()
-    lockedDependenciesDict[pname] = {"version": version, "sha256": sha256}
+for pname in depsDict:
+    depDict = depsDict[pname]
+    version = depDict["version"]
+    if "repository" in depDict:
+        repository = depDict["repository"]
+        strippedRepo = repository[4:]
+        eprint(f"Fetching {pname}@{version} ({strippedRepo})")
+        command = ["nix-prefetch-git", strippedRepo, version]
+        rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
+        sha256 = json.loads(rawRes)["sha256"]
+        lockedDepsDict[pname] = {"version": version, "repository": repository, "sha256": sha256}
+    else:
+        eprint(f"Fetching {pname}@{version}")
+        url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
+        command = ["nix-prefetch-url", "--type", "sha256", url]
+        sha256 = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout.rstrip()
+        lockedDepsDict[pname] = {"version": version, "sha256": sha256}
 
-print(json.dumps({"dependencies": lockedDependenciesDict}, indent=2))
+print(json.dumps({"dependencies": lockedDepsDict}, indent=2))
diff --git a/pkgs/build-support/kernel/compress-firmware-xz.nix b/pkgs/build-support/kernel/compress-firmware-xz.nix
deleted file mode 100644
index cb9ce7a71338..000000000000
--- a/pkgs/build-support/kernel/compress-firmware-xz.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ runCommand, lib }:
-
-firmware:
-
-let
-  args = {
-    allowedRequisites = [];
-  } // lib.optionalAttrs (firmware ? meta) { inherit (firmware) meta; };
-in
-
-runCommand "${firmware.name}-xz" args ''
-  mkdir -p $out/lib
-  (cd ${firmware} && find lib/firmware -type d -print0) |
-      (cd $out && xargs -0 mkdir -v --)
-  (cd ${firmware} && find lib/firmware -type f -print0) |
-      (cd $out && xargs -0rtP "$NIX_BUILD_CORES" -n1 \
-          sh -c 'xz -9c -T1 -C crc32 --lzma2=dict=2MiB "${firmware}/$1" > "$1.xz"' --)
-  (cd ${firmware} && find lib/firmware -type l) | while read link; do
-      target="$(readlink "${firmware}/$link")"
-      if [ -f "${firmware}/$link" ]; then
-        ln -vs -- "''${target/^${firmware}/$out}.xz" "$out/$link.xz"
-      else
-        ln -vs -- "''${target/^${firmware}/$out}" "$out/$link"
-      fi
-  done
-
-  echo "Checking for broken symlinks:"
-  find -L $out -type l -print -execdir false -- '{}' '+'
-''
diff --git a/pkgs/build-support/kernel/compress-firmware.nix b/pkgs/build-support/kernel/compress-firmware.nix
new file mode 100644
index 000000000000..0949036d5127
--- /dev/null
+++ b/pkgs/build-support/kernel/compress-firmware.nix
@@ -0,0 +1,43 @@
+{ runCommand, lib, type ? "zstd", zstd }:
+
+firmware:
+
+let
+  compressor = {
+    xz = {
+      ext = "xz";
+      nativeBuildInputs = [ ];
+      cmd = file: target: ''xz -9c -T1 -C crc32 --lzma2=dict=2MiB "${file}" > "${target}"'';
+    };
+    zstd = {
+      ext = "zst";
+      nativeBuildInputs = [ zstd ];
+      cmd = file: target: ''zstd -T1 -19 --long --check -f "${file}" -o "${target}"'';
+    };
+  }.${type} or (throw "Unsupported compressor type for firmware.");
+
+  args = {
+    allowedRequisites = [];
+    inherit (compressor) nativeBuildInputs;
+  } // lib.optionalAttrs (firmware ? meta) { inherit (firmware) meta; };
+in
+
+runCommand "${firmware.name}-${type}" args ''
+  mkdir -p $out/lib
+  (cd ${firmware} && find lib/firmware -type d -print0) |
+      (cd $out && xargs -0 mkdir -v --)
+  (cd ${firmware} && find lib/firmware -type f -print0) |
+      (cd $out && xargs -0rtP "$NIX_BUILD_CORES" -n1 \
+          sh -c '${compressor.cmd "${firmware}/$1" "$1.${compressor.ext}"}' --)
+  (cd ${firmware} && find lib/firmware -type l) | while read link; do
+      target="$(readlink "${firmware}/$link")"
+      if [ -f "${firmware}/$link" ]; then
+        ln -vs -- "''${target/^${firmware}/$out}.${compressor.ext}" "$out/$link.${compressor.ext}"
+      else
+        ln -vs -- "''${target/^${firmware}/$out}" "$out/$link"
+      fi
+  done
+
+  echo "Checking for broken symlinks:"
+  find -L $out -type l -print -execdir false -- '{}' '+'
+''
diff --git a/pkgs/build-support/kernel/modules-closure.sh b/pkgs/build-support/kernel/modules-closure.sh
index 5f61bac751af..06eb5b0d0de1 100644
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@@ -80,7 +80,7 @@ for module in $(< ~-/closure); do
     # of its output.
     modinfo -b $kernel --set-version "$version" -F firmware $module | grep -v '^name:' | while read -r i; do
         echo "firmware for $module: $i"
-        for name in "$i" "$i.xz" ""; do
+        for name in "$i" "$i.xz" "$i.zst" ""; do
             [ -z "$name" ] && echo "WARNING: missing firmware $i for module $module"
             if cp -v --parents --no-preserve=mode lib/firmware/$name "$out" 2>/dev/null; then
                 break
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 56375851783f..871f81bb5d69 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -40,10 +40,14 @@ rec {
         ${pkgs.stdenv.cc.libc}/lib/libc.so.* \
         ${pkgs.stdenv.cc.libc}/lib/libm.so.* \
         ${pkgs.stdenv.cc.libc}/lib/libresolv.so.* \
+        ${pkgs.stdenv.cc.libc}/lib/libpthread.so.* \
+        ${pkgs.zstd.out}/lib/libzstd.so.* \
+        ${pkgs.xz.out}/lib/liblzma.so.* \
         $out/lib
 
       # Copy BusyBox.
       cp -pd ${pkgs.busybox}/bin/* $out/bin
+      cp -pd ${pkgs.kmod}/bin/* $out/bin
 
       # Run patchelf to make the programs refer to the copied libraries.
       for i in $out/bin/* $out/lib/*; do if ! test -L $i; then nuke-refs $i; fi; done
@@ -54,6 +58,11 @@ rec {
               patchelf --set-interpreter $out/lib/ld-*.so.? --set-rpath $out/lib $i || true
           fi
       done
+
+      find $out/lib -type f \! -name 'ld*.so.?' | while read i; do
+        echo "patching $i..."
+        patchelf --set-rpath $out/lib $i
+      done
     ''; # */
 
 
diff --git a/pkgs/by-name/at/atac/package.nix b/pkgs/by-name/at/atac/package.nix
index 5f36c4ec356f..abb913352199 100644
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
       oniguruma
     ]
     ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.AppKit
       darwin.apple_sdk.frameworks.Security
       darwin.apple_sdk.frameworks.SystemConfiguration
     ];
diff --git a/pkgs/by-name/di/dim/package.nix b/pkgs/by-name/di/dim/package.nix
index 9b59329e766a..bf8140b471a7 100644
--- a/pkgs/by-name/di/dim/package.nix
+++ b/pkgs/by-name/di/dim/package.nix
@@ -11,6 +11,7 @@
   sqlite,
   libvaSupport ? stdenv.hostPlatform.isLinux,
   libva,
+  fetchpatch,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "dim";
@@ -45,6 +46,14 @@ rustPlatform.buildRustPackage rec {
     # (ffmpeg) binaries in the same directory as the binary. Patch it to use
     # the working dir and PATH instead.
     ./relative-paths.diff
+
+    # Upstream has some unused imports that prevent things from compiling...
+    # Remove for next release.
+    (fetchpatch {
+      name = "remove-unused-imports.patch";
+      url = "https://github.com/Dusk-Labs/dim/commit/f62de1d38e6e52f27b1176f0dabbbc51622274cb.patch";
+      hash = "sha256-Gk+RHWtCKN7McfFB3siIOOhwi3+k17MCQr4Ya4RCKjc=";
+    })
   ];
 
   postConfigure = ''
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 695623d209e0..900f7c598018 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -44,14 +44,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.14.11";
+  version = "3.14.13";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Ex4uJ50EiX9ZVzmndygxET0wZmPtPB4Ditjq5bdhKTQ=";
+    hash = "sha256-oBOD4kGrZaiAoK1vmr9FB9igMnraNpm0+mHqezHwC78=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/githooks/package.nix b/pkgs/by-name/gi/githooks/package.nix
index 349e5db06445..f4e4cd02bd86 100644
--- a/pkgs/by-name/gi/githooks/package.nix
+++ b/pkgs/by-name/gi/githooks/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "githooks";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "gabyx";
     repo = "githooks";
     rev = "v${version}";
-    hash = "sha256-qv0nl3EEYVo/s79r+yK3ZQCGPXM2bzGdWatPY24aOZg=";
+    hash = "sha256-gTvbvW+AFyZUBt7gSKJGc9lrl7CAy+cOElcADlIvuRk=";
   };
 
   modRoot = "./githooks";
diff --git a/pkgs/by-name/ma/makima/package.nix b/pkgs/by-name/ma/makima/package.nix
index 176432cdee7a..6ff1ddb8d98e 100644
--- a/pkgs/by-name/ma/makima/package.nix
+++ b/pkgs/by-name/ma/makima/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec{
   pname = "makima";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "cyber-sushi";
     repo = "makima";
     rev = "v${version}";
-    hash = "sha256-Zhr8j1JWxjwUZ3fjXKUEaKp3T6/dekeAxUDys6eniMQ=";
+    hash = "sha256-Orl79ETROaQzAraGGgYQSSreASanYQHkpEetIR8kJmo=";
   };
 
-  cargoHash = "sha256-LdgS833MKJOEnUmfvnH/sWG9RrRMNwbe5gAgXTUYzh8=";
+  cargoHash = "sha256-npnAbzy2EN3tK1/pSJnnucMj5lLn30lrgKtcPDl0HQQ=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix
index 2d1512f67ebc..0bd096f7977c 100644
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -112,7 +112,7 @@ in pythonpkgs.buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace mealie/__init__.py \
-      --replace-fail '__version__ = ' '__version__ = "${version}" #'
+      --replace-fail '__version__ = ' '__version__ = "v${version}" #'
   '';
 
   postInstall = let
diff --git a/pkgs/by-name/pa/paperless-asn-qr-codes/package.nix b/pkgs/by-name/pa/paperless-asn-qr-codes/package.nix
new file mode 100644
index 000000000000..1661d7a5a485
--- /dev/null
+++ b/pkgs/by-name/pa/paperless-asn-qr-codes/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "paperless-asn-qr-codes";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "entropia";
+    repo = "paperless-asn-qr-codes";
+    rev = "v${version}";
+    hash = "sha256-/xCU6xDrmhkua4Iw/BCzhOuqO5GT/0rTJ+Y59wuMz6E=";
+  };
+
+  prePatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "\"argparse\"," ""
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.hatch-vcs
+    python3.pkgs.hatchling
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    reportlab
+    reportlab-qrcode
+  ];
+
+  pythonImportsCheck = [ "paperless_asn_qr_codes" ];
+
+  meta = with lib; {
+    description = "Command line utility for generating ASN labels for paperless with both a human-readable representation, as well as a QR code for machine consumption";
+    homepage = "https://github.com/entropia/paperless-asn-qr-codes";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ xanderio ];
+    mainProgram = "paperless-asn-qr-codes";
+  };
+}
diff --git a/pkgs/by-name/sp/spectral-language-server/package.json b/pkgs/by-name/sp/spectral-language-server/package.json
new file mode 100644
index 000000000000..1f3651349c62
--- /dev/null
+++ b/pkgs/by-name/sp/spectral-language-server/package.json
@@ -0,0 +1,159 @@
+{
+  "activationEvents": [
+    "onStartupFinished"
+  ],
+  "author": "Stoplight <support@stoplight.io>",
+  "bugs": {
+    "url": "https://github.com/stoplightio/vscode-spectral/issues"
+  },
+  "categories": [
+    "Linters"
+  ],
+  "contributes": {
+    "configuration": {
+      "properties": {
+        "spectral.enable": {
+          "default": true,
+          "description": "Controls whether or not Spectral is enabled.",
+          "scope": "resource",
+          "type": "boolean"
+        },
+        "spectral.rulesetFile": {
+          "description": "Location of the ruleset file to use when validating. If omitted, the default is a .spectral.yml/.spectral.json in the same folder as the document being validated. Paths are relative to the workspace. This can also be a remote HTTP url.",
+          "scope": "resource",
+          "type": "string"
+        },
+        "spectral.run": {
+          "default": "onType",
+          "description": "Run the linter on save (onSave) or as you type (onType).",
+          "enum": [
+            "onSave",
+            "onType"
+          ],
+          "scope": "resource",
+          "type": "string"
+        },
+        "spectral.trace.server": {
+          "default": "off",
+          "description": "Traces the communication between VS Code and the language server.",
+          "enum": [
+            "off",
+            "messages",
+            "verbose"
+          ],
+          "scope": "window",
+          "type": "string"
+        },
+        "spectral.validateFiles": {
+          "description": "An array of file globs (e.g., `**/*.yaml`) in minimatch glob format which should be validated by Spectral. If language identifiers are also specified, the file must match both in order to be validated. You can also use negative file globs (e.g., `!**/package.json`) here to exclude files.",
+          "items": {
+            "type": "string"
+          },
+          "scope": "resource",
+          "type": "array"
+        },
+        "spectral.validateLanguages": {
+          "default": [
+            "json",
+            "yaml"
+          ],
+          "description": "An array of language IDs which should be validated by Spectral. If file globs are also specified, the file must match both in order to be validated.",
+          "items": {
+            "type": "string"
+          },
+          "scope": "resource",
+          "type": "array"
+        }
+      },
+      "title": "Spectral",
+      "type": "object"
+    },
+    "commands": [
+      {
+        "title": "Show Output Channel",
+        "category": "Spectral",
+        "command": "spectral.showOutputChannel"
+      }
+    ]
+  },
+  "description": "JSON/YAML linter with OpenAPI and custom ruleset support.",
+  "devDependencies": {
+    "@types/chai": "^4.3.1",
+    "@types/chai-jest-snapshot": "^1.3.6",
+    "@types/glob": "^7.2.0",
+    "@types/mocha": "^9.1.0",
+    "@types/node": "^18.11.18",
+    "@types/vscode": "^1.48.0",
+    "@typescript-eslint/eslint-plugin": "^4.33.0",
+    "@typescript-eslint/parser": "^4.1.0",
+    "chai": "^4.2.0",
+    "chai-jest-snapshot": "^2.0.0",
+    "copyfiles": "^2.4.1",
+    "cross-env": "^7.0.3",
+    "eslint": "^7.8.1",
+    "eslint-config-google": "^0.14.0",
+    "glob": "^8.0.3",
+    "http-test-servers": "^2.0.0",
+    "merge-options": "^3.0.0",
+    "mocha": "^8.1.3",
+    "rimraf": "^3.0.2",
+    "semver": "^7.3.2",
+    "shelljs": "^0.8.5",
+    "ts-loader": "^9.2.8",
+    "ts-node": "^8.10.2",
+    "typescript": "beta",
+    "vsce": "^1.103.1",
+    "vscode-test": "^1.5.0",
+    "webpack": "^5.72.0",
+    "webpack-cli": "^4.9.2"
+  },
+  "displayName": "Spectral",
+  "engines": {
+    "vscode": "^1.48.0",
+    "node": "^12.20 || >= 14.13"
+  },
+  "homepage": "https://github.com/stoplightio/vscode-spectral",
+  "icon": "icon.png",
+  "keywords": [
+    "linter",
+    "validator",
+    "OpenAPI",
+    "Swagger",
+    "API",
+    "style guide",
+    "API description",
+    "API specification",
+    "OAS",
+    "OAS2",
+    "OAS3",
+    "AsyncAPI",
+    "json",
+    "yaml"
+  ],
+  "license": "Apache-2.0",
+  "main": "./client/index.js",
+  "name": "spectral",
+  "private": true,
+  "publisher": "stoplight",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/stoplightio/vscode-spectral"
+  },
+  "scripts": {
+    "clean": "rimraf dist && rimraf \"{server,client}/dist\"",
+    "lint": "eslint --ext .ts,.js .",
+    "test": "mocha -r ts-node/register \"./+(client|server)/__tests__/unit/**/*.test.ts\"",
+    "test:e2e": "cross-env CI=true CHAI_JEST_SNAPSHOT_UPDATE_ALL=false ts-node ./client/src/__tests__/e2e/index.ts"
+  },
+  "version": "1.1.2",
+  "workspaces": {
+    "packages": [
+      "client",
+      "server"
+    ],
+    "nohoist": [
+      "client/**",
+      "server/**"
+    ]
+  }
+}
diff --git a/pkgs/by-name/sp/spectral-language-server/package.nix b/pkgs/by-name/sp/spectral-language-server/package.nix
new file mode 100644
index 000000000000..8193ff3acebd
--- /dev/null
+++ b/pkgs/by-name/sp/spectral-language-server/package.nix
@@ -0,0 +1,109 @@
+{ lib
+, buildNpmPackage
+, mkYarnPackage
+, fetchYarnDeps
+, fetchFromGitHub
+, typescript
+, jq
+, fetchpatch
+}:
+let
+  # Instead of the build script that spectral-language-server provides (ref: https://github.com/luizcorreia/spectral-language-server/blob/master/script/vscode-spectral-build.sh), we build vscode-spectral manually.
+  # This is because the script must go through the network and will not work under the Nix sandbox environment.
+  vscodeSpectral = mkYarnPackage rec {
+    pname = "vscode-spectral";
+    version = "1.1.2";
+
+    src = fetchFromGitHub {
+      owner = "stoplightio";
+      repo = "vscode-spectral";
+      rev = "v${version}";
+      hash = "sha256-TWy+bC6qhTKDY874ORTBbvCIH8ycpmBiU8GLYxBIiAs=";
+    };
+
+    packageJSON = ./package.json;
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = src + "/yarn.lock";
+      hash = "sha256-am27A9VyFoXuOlgG9mnvNqV3Q7Bi7GJzDqqVFGDVWIA=";
+    };
+
+    nativeBuildInputs = [ typescript jq ];
+
+    postPatch = ''
+      cp server/tsconfig.json server/tsconfig.json.bak
+      jq '.compilerOptions += {"module": "NodeNext", "moduleResolution": "NodeNext"}' server/tsconfig.json.bak > server/tsconfig.json
+    '';
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+      # FIXME: vscode-spactral depends on @rollup/pluginutils, but it may have a bug that doesn't provide the type definitions for NodeNext module resolution. (ref: https://github.com/rollup/plugins/issues/1192)
+      # tsc detects some type errors in the code. However we ignore this because it's not a problem for the final build if server/dist is generated.
+      tsc -p server || true
+      test -d server/dist
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -R server/dist $out
+      runHook postInstall
+    '';
+
+    doDist = false;
+
+    meta = with lib; {
+      homepage = "https://github.com/stoplightio/vscode-spectral";
+      description = "VS Code extension bringing the awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
+      license = licenses.asl20;
+    };
+  };
+in
+buildNpmPackage rec {
+  pname = "spectral-language-server";
+  version = "1.0.8-unstable-2023-06-06";
+
+  src = fetchFromGitHub {
+    owner = "luizcorreia";
+    repo = "spectral-language-server";
+    rev = "c9a7752b08e6bba937ef4f5435902afd41b6957f";
+    hash = "sha256-VD2aAzlCnJ6mxPUSbNRfMOlslM8kLPqrAI2ah6sX9cU=";
+  };
+
+  npmDepsHash = "sha256-ixAXy/rRkyWL3jdAkrXJh1qhWcKIkr5nH/Bhu2JV6k8=";
+
+  patches = [
+    # https://github.com/luizcorreia/spectral-language-server/pull/15
+    (fetchpatch {
+      name = "fix-package-lock.patch";
+      url = "https://github.com/luizcorreia/spectral-language-server/commit/909704850dd10e7b328fc7d15f8b07cdef88899d.patch";
+      hash = "sha256-+mN93xP4HCll4dTcnh2W/m9k3XovvgnB6AOmuJpZUZ0=";
+    })
+  ];
+
+  dontNpmBuild = true;
+
+  npmFlags = [ "--ignore-scripts" ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    mkdir -p $out/node_modules
+    mkdir -p $out/dist/spectral-language-server
+    cp -R ${vscodeSpectral}/dist/* $out/dist/spectral-language-server/
+    cp ./bin/* $out/bin
+    cp -R ./node_modules/* $out/node_modules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/luizcorreia/spectral-language-server";
+    description = "Awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
+    maintainers = with maintainers; [ momeemt ];
+    license = licenses.mit;
+    mainProgram = "spectral-language-server";
+  };
+}
diff --git a/pkgs/by-name/te/tenv/package.nix b/pkgs/by-name/te/tenv/package.nix
index d974007a2037..ac334c508d16 100644
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tenv";
-  version = "1.9.4";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "tofuutils";
     repo = "tenv";
     rev = "v${version}";
-    hash = "sha256-lrBoZwdhDPE2cGTxptMV6PChUdHe99n7AqCozMUkXk0=";
+    hash = "sha256-c283egT5KOcR+PjwWnKkCI3RKr+Tqa6a+ORsjq4wuXs=";
   };
 
-  vendorHash = "sha256-NMkR90+kJ3VsuhF45l5K68uOqenPfINZDEE0GfjULro=";
+  vendorHash = "sha256-GAUpQbZfaF3N2RaQO0ZDe8DywOZwIfXNImsZCk6iB+U=";
 
   # Tests disabled for requiring network access to release.hashicorp.com
   doCheck = false;
diff --git a/pkgs/by-name/wl/wlr-layout-ui/package.nix b/pkgs/by-name/wl/wlr-layout-ui/package.nix
index f115bf12159b..efa72ee133d9 100644
--- a/pkgs/by-name/wl/wlr-layout-ui/package.nix
+++ b/pkgs/by-name/wl/wlr-layout-ui/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "wlr-layout-ui";
-  version = "1.4.7";
+  version = "1.6.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fdev31";
     repo = "wlr-layout-ui";
-    rev = "${version}";
-    hash = "sha256-3NV02/Lk43h3r17jwmSAqx7wofaHFJKDh+vaWwU17Gw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-UM1p5b5+xJY6BgPUMXjluIC9zQxe388+gBWTbNQPWYQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index e8e4a66dddcc..e8d2f665f919 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.7.120";
+  version = "0.7.121";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
+    hash = "sha256-VcztVzG/IN9N0SVKj6BipyqnhxXC2nTTuMjKMtFKzGw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/flat-remix-gnome/default.nix b/pkgs/data/themes/flat-remix-gnome/default.nix
index 13c3de856153..3cd6710e5b93 100644
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@@ -7,25 +7,25 @@
 let
   # make install will use dconf to find desktop background file uri.
   # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20240418/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20240503/Makefile#L38
   fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
   pname = "flat-remix-gnome";
-  version = "20240418";
+  version = "20240503";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    hash = "sha256-o6WjXPE4uuCDYNqzj0rkOC/RLmZVenEuaSiu8PS4kx4=";
+    hash = "sha256-02hYxgq8Go++oYT8r86wA7HVXQJeUZ0JpwIu3VWfjQE=";
   };
 
   nativeBuildInputs = [ glib fake-dconf ];
   makeFlags = [ "PREFIX=$(out)" ];
 
   # make install will back up this file, it will fail if the file doesn't exist.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20240418/Makefile#L56
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20240503/Makefile#L56
   preInstall = ''
     mkdir -p $out/share/gnome-shell/
     touch $out/share/gnome-shell/gnome-shell-theme.gresource
diff --git a/pkgs/desktops/lxqt/libfm-qt/default.nix b/pkgs/desktops/lxqt/libfm-qt/default.nix
index 0ef27be05d2b..2ec04386b3ec 100644
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@@ -15,7 +15,7 @@
 , qttools
 , wrapQtAppsHook
 , gitUpdater
-, version ? "2.0.0"
+, version ? "2.0.1"
 , qtx11extras ? null
 }:
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     rev = version;
     hash = {
       "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
-      "2.0.0" = "sha256-vWkuPdG5KaT6KMr1NJGt7JBUd1z3wROKY79otsrRsuI=";
+      "2.0.1" = "sha256-iU55tUjN01+hTHTM6784OxoAiK6SbsSnUXHTL56iIF0=";
     }."${version}";
   };
 
diff --git a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
index 0ca6d4fe61fe..df5f6ed911ca 100644
--- a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lxqt-notificationd";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-zEoTjDD65bBJBbvAZVtov8HyiN1G6CqYkmcPH4T8Jhc=";
+    hash = "sha256-qmBHeXKBJD97Me2zNSn7bNr0UrObGmvj8Pn19GQGktI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
index 6f668abb7ea5..f88f32fb11fc 100644
--- a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
+++ b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-lxqt";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    hash = "sha256-JSbFZ7R1Cu5VPPb50fRVSAsaE0LE15BbbHpvJZP6+w0=";
+    hash = "sha256-zXZ0Un56uz1hKoPvZitJgQpJ7ko0LrSSFxl+agiqZ4A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/granite/7/default.nix b/pkgs/desktops/pantheon/granite/7/default.nix
index 5abffc0cc677..747e24a705ac 100644
--- a/pkgs/desktops/pantheon/granite/7/default.nix
+++ b/pkgs/desktops/pantheon/granite/7/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "granite";
-  version = "7.4.0";
+  version = "7.5.0";
 
   outputs = [ "out" "dev" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-z/6GxWfbsngySv2ziNwzhcEfTamxP1DnJ2ld9fft/1U=";
+    sha256 = "sha256-mwivme79zsPcS+Ol8iApECjpQz+fYcBLZwkULagXVvI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/gnu-cim/default.nix b/pkgs/development/compilers/gnu-cim/default.nix
index 54ba6cffff13..f689517196a1 100644
--- a/pkgs/development/compilers/gnu-cim/default.nix
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+  env.CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type -Wno-error=implicit-function-declaration -Wno-error=implicit-int";
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index c8d62f2917dc..92a28d8a7705 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -40,7 +40,7 @@
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
 , withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
 , withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
-, withAvisynth ? withFullDeps && !stdenv.isDarwin # AviSynth script files reading; Darwin currently broken because libdevil fails to build
+, withAvisynth ? withFullDeps # AviSynth script files reading
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
diff --git a/pkgs/development/libraries/opendht/default.nix b/pkgs/development/libraries/opendht/default.nix
index 7209c2d2e253..ea568cdfa52a 100644
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opendht";
-  version = "3.1.4";
+  version = "3.1.11";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     rev = "v${version}";
-    hash = "sha256-KtsQ25uStmlf7RZLAcabhPMyGbxKxvpR6Vm632+EBvw=";
+    hash = "sha256-lJaQGkhpKfSSNVbP+NqommagtoWyi8CdauVxEhiI9Bc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index b836220efaff..410ef47b1bc3 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-Az5QZNnzLYpEE7O+1/VceIT6vykkg8vMuAuN9u8OseM=";
+    sha256 = "sha256-7YW0ylYQMi6D7YyRQGWRv980skjZ2t//QoZb8rRDHGk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/xml-security-c/default.nix b/pkgs/development/libraries/xml-security-c/default.nix
index 6be958d7d24d..c9e4c5874aef 100644
--- a/pkgs/development/libraries/xml-security-c/default.nix
+++ b/pkgs/development/libraries/xml-security-c/default.nix
@@ -1,12 +1,24 @@
-{ lib, stdenv, fetchurl, xalanc, xercesc, openssl, pkg-config }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xalanc,
+  xercesc,
+  openssl,
+  darwin,
+}:
 
-stdenv.mkDerivation rec {
+let
+  inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices SystemConfiguration;
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "xml-security-c";
   version = "2.0.4";
 
   src = fetchurl {
-    url = "mirror://apache/santuario/c-library/${pname}-${version}.tar.gz";
-    sha256 = "sha256-p42mcg9sK6FBANJCYTHg0z6sWi26XMEb3QSXS364kAM=";
+    url = "mirror://apache/santuario/c-library/xml-security-c-${finalAttrs.version}.tar.gz";
+    hash = "sha256-p42mcg9sK6FBANJCYTHg0z6sWi26XMEb3QSXS364kAM=";
   };
 
   configureFlags = [
@@ -16,7 +28,18 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ xalanc xercesc openssl ];
+
+  buildInputs =
+    [
+      xalanc
+      xercesc
+      openssl
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      CoreFoundation
+      CoreServices
+      SystemConfiguration
+    ];
 
   meta = {
     homepage = "https://santuario.apache.org/";
@@ -25,4 +48,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.jagajaga ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/betterproto/default.nix b/pkgs/development/python-modules/betterproto/default.nix
index a20daf344f06..5f42d46b1e58 100644
--- a/pkgs/development/python-modules/betterproto/default.nix
+++ b/pkgs/development/python-modules/betterproto/default.nix
@@ -61,6 +61,7 @@ buildPythonPackage rec {
   # The tests require the generation of code before execution. This requires
   # the protoc-gen-python_betterproto script from the package to be on PATH.
   preCheck = ''
+    (($(ulimit -n) < 1024)) && ulimit -n 1024
     export PATH=$PATH:$out/bin
     patchShebangs src/betterproto/plugin/main.py
     ${python.interpreter} -m tests.generate
diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
new file mode 100644
index 000000000000..6418163b6bc7
--- /dev/null
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -0,0 +1,98 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, absl-py
+, mujoco
+, pyparsing
+, pythonRelaxDepsHook
+, setuptools
+, wheel
+, dm-env
+, dm-tree
+, fsspec
+, glfw
+, h5py
+, lxml
+, mock
+, nose
+, nose-xunitmp
+, numpy
+, pillow
+, protobuf
+, pyopengl
+, requests
+, scipy
+, tqdm
+, etils
+}:
+
+buildPythonPackage rec {
+  pname = "dm-control";
+  version = "1.0.19";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "google-deepmind";
+    repo = "dm_control";
+    rev = "refs/tags/${version}";
+    hash = "sha256-q9hY/icvc1tPI0xBYxExc2a+gv0i6utaB4GBnJwQPCw=";
+  };
+
+  build-system = [
+    absl-py
+    mujoco
+    pyparsing
+    pythonRelaxDepsHook
+    setuptools
+    wheel
+  ];
+
+  pythonRemoveDeps = [
+    # Unpackaged
+    "labmaze"
+  ];
+
+  dependencies = [
+    absl-py
+    dm-env
+    dm-tree
+    fsspec
+    glfw
+    h5py
+    lxml
+    mock
+    mujoco
+    nose
+    nose-xunitmp
+    numpy
+    pillow
+    protobuf
+    pyopengl
+    pyparsing
+    requests
+    scipy
+    setuptools
+    tqdm
+  ] ++ etils.optional-dependencies.epath;
+
+  pythonImportsCheck = [
+    "dm_control"
+  ];
+
+  # The installed library clashes with the `dm_control` directory remaining in the source path.
+  # Usually, we get around this by `rm -rf` the python source files to ensure that the installed package is used.
+  # Here, we cannot do that as it would also remove the tests which are also in the `dm_control` directory.
+  # See https://github.com/google-deepmind/dm_control/issues/6
+  doCheck = false;
+
+  meta = {
+    changelog = "https://github.com/google-deepmind/dm_control/releases/tag/${version}";
+    description = "Google DeepMind's software stack for physics-based simulation and Reinforcement Learning environments, using MuJoCo";
+    homepage = "https://github.com/google-deepmind/dm_control";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/ffmpy/default.nix b/pkgs/development/python-modules/ffmpy/default.nix
index 974e2bcd8fda..880a8f84ee75 100644
--- a/pkgs/development/python-modules/ffmpy/default.nix
+++ b/pkgs/development/python-modules/ffmpy/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
@@ -44,6 +45,11 @@ buildPythonPackage rec {
     go
   ];
 
+  disabledTests = lib.optionals stdenv.isDarwin [
+    # expects a FFExecutableNotFoundError, gets a NotADirectoryError raised by os
+    "test_invalid_executable_path"
+  ];
+
   # the vendored ffmpeg mock binary assumes FHS
   preCheck = ''
     rm -v tests/ffmpeg/ffmpeg
diff --git a/pkgs/development/python-modules/fpdf2/default.nix b/pkgs/development/python-modules/fpdf2/default.nix
index fdd43f1ca5c8..b3a764724c46 100644
--- a/pkgs/development/python-modules/fpdf2/default.nix
+++ b/pkgs/development/python-modules/fpdf2/default.nix
@@ -57,6 +57,9 @@ buildPythonPackage rec {
     "test_png_url" # tries to download file
     "test_page_background" # tries to download file
     "test_share_images_cache" # uses timing functions
+    "test_bidi_character" # tries to download file
+    "test_bidi_conformance" # tries to download file
+    "test_insert_jpg_jpxdecode" # JPEG2000 is broken
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/internetarchive/default.nix b/pkgs/development/python-modules/internetarchive/default.nix
index 11a089b376d3..5beb0cc44e1a 100644
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "internetarchive";
-  version = "4.0.1";
+  version = "4.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jjjake";
     repo = "internetarchive";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U6idxc5U2Bt581c/vnGgIou5+hoEJJZSPCo97MEDaW4=";
+    hash = "sha256-CqfwAKhrq4VEBU258x19JT8+ay2vOYIzVoFWjAzh3wY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/islpy/default.nix b/pkgs/development/python-modules/islpy/default.nix
index ca84beae2eef..83f0b26c0047 100644
--- a/pkgs/development/python-modules/islpy/default.nix
+++ b/pkgs/development/python-modules/islpy/default.nix
@@ -1,41 +1,71 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, isl
-, pybind11
-, pytestCheckHook
-, pythonOlder
-, six
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+
+  setuptools,
+  cmake,
+  nanobind,
+  ninja,
+  pcpp,
+  scikit-build,
+  isl,
+
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "islpy";
   version = "2023.2.5";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-3XQ5i682k4q7fCqdmCjMGi5UnGyASFzsiwaymr+q0Y8=";
+  src = fetchFromGitHub {
+    owner = "inducer";
+    repo = "islpy";
+    rev = "v${version}";
+    hash = "sha256-0m41G5HlPrgt4rDY3Y9cKBJGHSnLg/R+IywBO1anRpQ=";
   };
 
-  postConfigure = ''
-    substituteInPlace setup.py \
-      --replace "\"pytest>=2\"," ""
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+        --replace-fail "setuptools>=42,<64;python_version<'3.12'" "setuptools>=42"
   '';
 
-  buildInputs = [ isl pybind11 ];
-  propagatedBuildInputs = [ six ];
+  build-system = [
+    setuptools
+    cmake
+    nanobind
+    ninja
+    pcpp
+    scikit-build
+  ];
+
+  buildInputs = [ isl ];
+
+  dontUseCmakeConfigure = true;
+
+  preConfigure = ''
+    python ./configure.py \
+        --no-use-shipped-isl \
+        --isl-inc-dir=${lib.getDev isl}/include \
+  '';
+
+  # Force resolving the package from $out to make generated ext files usable by tests
+  preCheck = ''
+    mv islpy islpy.hidden
+  '';
 
-  preCheck = "mv islpy islpy.hidden";
   nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "islpy" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python wrapper around isl, an integer set library";
     homepage = "https://github.com/inducer/islpy";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tomasajt ];
   };
 }
diff --git a/pkgs/development/python-modules/latex2mathml/default.nix b/pkgs/development/python-modules/latex2mathml/default.nix
index 99d9dcc5fb74..0cf0276a73a0 100644
--- a/pkgs/development/python-modules/latex2mathml/default.nix
+++ b/pkgs/development/python-modules/latex2mathml/default.nix
@@ -11,6 +11,7 @@
 buildPythonPackage rec {
   pname = "latex2mathml";
   version = "3.77.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -21,9 +22,7 @@ buildPythonPackage rec {
     hash = "sha256-DLdSFMsNA0gD6Iw0kn+0IrbvyI0VEGOpz0ZYD48nRkY=";
   };
 
-  format = "pyproject";
-
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
@@ -45,6 +44,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/roniemartinez/latex2mathml";
     changelog = "https://github.com/roniemartinez/latex2mathml/releases/tag/${version}";
     license = licenses.mit;
+    mainProgram = "latex2mathml";
     maintainers = with maintainers; [ sfrijters ];
   };
 }
diff --git a/pkgs/development/python-modules/llama-index-agent-openai/default.nix b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
index 2fb90a615f46..09f2d549225d 100644
--- a/pkgs/development/python-modules/llama-index-agent-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-agent-openai/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-agent-openai";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_agent_openai";
     inherit version;
-    hash = "sha256-yJnZCzIDZlao74bQ8DeNQWjgDrLXWhCQHqtYulsmVqQ=";
+    hash = "sha256-zUpY+L8jNyjO2lVMuzTeVqK2u7v/bOgBw/j/DIKAv1U=";
   };
 
   pythonRelaxDeps = [ "llama-index-llms-openai" ];
diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix
index 0c76c6f8c471..2a47a00a5ac9 100644
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@@ -44,7 +44,7 @@ in
 
 buildPythonPackage rec {
   pname = "llama-index-core";
-  version = "0.10.34";
+  version = "0.10.35";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "run-llama";
     repo = "llama_index";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KOoTN+ERJZHOer82lLBTWzWW5MIoJaqOmhoa3HYk0fs=";
+    hash = "sha256-aExejThQPp4rnAiedj/zzgzwIGvLzeARKOTy1VVF1Ys=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/llama-index-llms-openai/default.nix b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
index 288fa1d35c4d..b621d91baed3 100644
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-openai";
-  version = "0.1.16";
+  version = "0.1.17";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_openai";
     inherit version;
-    hash = "sha256-MTu8F8JBmSQwpr9oahse3EJ2yCVq1rBVCqG+oeD+0aY=";
+    hash = "sha256-ZtOvdh3CMjiLVKAXsMuEAevXTALWnK59YE2CiOwbaD0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/loopy/default.nix b/pkgs/development/python-modules/loopy/default.nix
index 995c99e100ec..488d055b7213 100644
--- a/pkgs/development/python-modules/loopy/default.nix
+++ b/pkgs/development/python-modules/loopy/default.nix
@@ -1,39 +1,47 @@
-{ lib
-, buildPythonPackage
-, codepy
-, cgen
-, colorama
-, fetchFromGitHub
-, genpy
-, islpy
-, mako
-, numpy
-, pymbolic
-, pyopencl
-, pyrsistent
-, pythonOlder
-, pytools
+{
+  lib,
+  buildPythonPackage,
+  codepy,
+  cgen,
+  colorama,
+  fetchFromGitHub,
+  genpy,
+  immutables,
+  islpy,
+  mako,
+  numpy,
+  pymbolic,
+  pyopencl,
+  pyrsistent,
+  pythonOlder,
+  pytools,
+  setuptools,
+  typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "loopy";
   version = "2024.1";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "inducer";
-    repo = pname;
+    repo = "loopy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R0Wry4r8Y7VKqsyrZ3odEOUy4T9di9rFQzq7BD0LG58=";
+    hash = "sha256-mU8vXEPR88QpJpzXZlZdDhMtlwIx5YpeYhXU8Vw2T9g=";
+    fetchSubmodules = true; # submodule at `loopy/target/c/compyte`
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     codepy
     cgen
     colorama
     genpy
+    immutables
     islpy
     mako
     numpy
@@ -41,15 +49,22 @@ buildPythonPackage rec {
     pyopencl
     pyrsistent
     pytools
+    typing-extensions
   ];
 
+  postConfigure = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  pythonImportsCheck = [ "loopy" ];
+
   # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "A code generator for array-based code on CPUs and GPUs";
     homepage = "https://github.com/inducer/loopy";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tomasajt ];
   };
 }
diff --git a/pkgs/development/python-modules/nose-xunitmp/default.nix b/pkgs/development/python-modules/nose-xunitmp/default.nix
new file mode 100644
index 000000000000..ee344b2e07ca
--- /dev/null
+++ b/pkgs/development/python-modules/nose-xunitmp/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, wheel
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "nose-xunitmp";
+  version = "0.4.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "nose_xunitmp";
+    inherit version;
+    hash = "sha256-wt9y9HYHUdMBU9Rzgiqr8afD1GL2ZKp/f9uNxibcfEA=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    nose
+  ];
+
+  pythonImportsCheck = [
+    "nose_xunitmp"
+  ];
+
+  meta = {
+    description = "Xunit output when running multiprocess tests using nose";
+    homepage = "https://pypi.org/project/nose_xunitmp/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/pylutron/default.nix b/pkgs/development/python-modules/pylutron/default.nix
index 49ee5e278485..f486b45c6798 100644
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@@ -1,34 +1,34 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pylutron";
-  version = "0.2.12";
+  version = "0.2.13";
   pyproject = true;
 
+  disabled = pythonOlder "3.7";
+
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-UTn4HfyiyQAekIZD4I5lacYb7ySRhW8OUgiOg33JZtQ=";
+    hash = "sha256-s5qprIVPlq495XWKjgIuohDzPV0EfU43zkfQ2DvH04Y=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "pylutron"
-  ];
+  pythonImportsCheck = [ "pylutron" ];
 
   meta = with lib; {
-    changelog = "https://github.com/thecynic/pylutron/releases/tag/${version}";
     description = "Python library for controlling a Lutron RadioRA 2 system";
     homepage = "https://github.com/thecynic/pylutron";
+    changelog = "https://github.com/thecynic/pylutron/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/redis-om/default.nix b/pkgs/development/python-modules/redis-om/default.nix
index 1549b891636f..4e84e3ea37c4 100644
--- a/pkgs/development/python-modules/redis-om/default.nix
+++ b/pkgs/development/python-modules/redis-om/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "redis-om";
-  version = "0.2.2";
+  version = "0.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "redis";
     repo = "redis-om-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-E11wpTrE+HIT+jgn1zMC8L7RGas83DAJd1R0WWHp7Jc=";
+    hash = "sha256-jwFtRnj/jhH+AKjExdOCgUfgEWweFCXVuz6F3qQRcs0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/reportlab-qrcode/default.nix b/pkgs/development/python-modules/reportlab-qrcode/default.nix
new file mode 100644
index 000000000000..97d1e9d13732
--- /dev/null
+++ b/pkgs/development/python-modules/reportlab-qrcode/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, wheel
+, qrcode
+, reportlab
+, pillow
+, pytest
+, pyzbar
+}:
+
+buildPythonPackage rec {
+  pname = "reportlab-qrcode";
+  version = "0.1.6";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-m/oeuA797MEBOJBIG157VIa7TbEbRRVK/O8Arz/oO/o=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    qrcode
+    reportlab
+  ];
+
+  passthru.optional-dependencies = {
+    testing = [
+      pillow
+      pytest
+      pyzbar
+    ];
+  };
+
+  pythonImportsCheck = [ "reportlab_qrcode" ];
+
+  meta = with lib; {
+    description = "Allows to create QR codes for use with the ReportLab PDF library";
+    homepage = "https://pypi.org/project/reportlab-qrcode/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ xanderio ];
+  };
+}
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index 1a5e1ab8f461..af7dc8a45110 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -89,8 +89,12 @@ buildPythonPackage rec {
     "test_check_live_cached"
     "test_get_packages_licenses_without_api_key"
     "test_validate_with_policy_file_using_invalid_keyword"
+    "test_validate_with_basic_policy_file"
   ];
 
+  # ImportError: cannot import name 'get_command_for' from partially initialized module 'safety.cli_util' (most likely due to a circular import)
+  disabledTestPaths = [ "tests/alerts/test_utils.py" ];
+
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
diff --git a/pkgs/development/python-modules/shimmy/default.nix b/pkgs/development/python-modules/shimmy/default.nix
new file mode 100644
index 000000000000..cbe0ca7cc8d7
--- /dev/null
+++ b/pkgs/development/python-modules/shimmy/default.nix
@@ -0,0 +1,92 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, setuptools
+, wheel
+, gymnasium
+, numpy
+, ale-py
+, bsuite
+, dm-control
+, gym
+, imageio
+, pettingzoo
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "shimmy";
+  version = "1.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "Farama-Foundation";
+    repo = "Shimmy";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rYBbGyMSFF/iIGruKn2JXKAVIZIfJDEHUEZUESiUg/k=";
+  };
+
+  build-system = [
+    setuptools
+    wheel
+  ];
+
+  dependencies = [
+    gymnasium
+    numpy
+  ];
+
+  pythonImportsCheck = [ "shimmy" ];
+
+  nativeCheckInputs = [
+    ale-py
+    bsuite
+    dm-control
+    gym
+    imageio
+    pettingzoo
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Requires unpackaged pyspiel
+    "tests/test_openspiel.py"
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # Require network access
+    "test_check_env[bsuite/mnist_noise-v0]"
+    "test_check_env[bsuite/mnist_scale-v0]"
+    "test_check_env[bsuite/mnist-v0]"
+    "test_existing_env"
+    "test_loading_env"
+    "test_pickle[bsuite/mnist-v0]"
+    "test_seeding[bsuite/mnist_noise-v0]"
+    "test_seeding[bsuite/mnist_scale-v0]"
+    "test_seeding[bsuite/mnist-v0]"
+    "test_seeding"
+
+    # RuntimeError: std::exception
+    "test_check_env"
+    "test_seeding[dm_control/quadruped-escape-v0]"
+    "test_rendering_camera_id"
+    "test_rendering_multiple_cameras"
+    "test_rendering_depth"
+    "test_render_height_widths"
+  ];
+
+  meta = {
+    changelog = "https://github.com/Farama-Foundation/Shimmy/releases/tag/v${version}";
+    description = "An API conversion tool for popular external reinforcement learning environments";
+    homepage = "https://github.com/Farama-Foundation/Shimmy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/smart-open/default.nix b/pkgs/development/python-modules/smart-open/default.nix
index b9622276bdf8..470de7e118e0 100644
--- a/pkgs/development/python-modules/smart-open/default.nix
+++ b/pkgs/development/python-modules/smart-open/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, fetchpatch
 , azure-common
 , azure-core
 , azure-storage-blob
@@ -31,6 +32,16 @@ buildPythonPackage rec {
     hash = "sha256-4HOTaF6AKXGlVCvSGKnnaH73aa4IO0aRxz03XQ4gSd8=";
   };
 
+  patches = [
+    # https://github.com/RaRe-Technologies/smart_open/pull/822
+    # fix test_smart_open.py on python 3.12
+    (fetchpatch {
+      name = "fix-smart-open-test.patch";
+      url = "https://github.com/RaRe-Technologies/smart_open/commit/3d29564ca034a56d343c9d14b178aaa0ff4c937c.patch";
+      hash = "sha256-CrAeqaIMM8bctWiFnq9uamnIlkaslDyjaWL6k9wUjT8=";
+    })
+  ];
+
   build-system = [
     setuptools
   ];
diff --git a/pkgs/development/python-modules/type-infer/default.nix b/pkgs/development/python-modules/type-infer/default.nix
index 1e1021503100..b94b06e8a1cb 100644
--- a/pkgs/development/python-modules/type-infer/default.nix
+++ b/pkgs/development/python-modules/type-infer/default.nix
@@ -10,6 +10,7 @@
 , numpy
 , pandas
 , psutil
+, py3langid
 , python-dateutil
 , scipy
 , toml
@@ -48,6 +49,7 @@ buildPythonPackage rec {
     numpy
     pandas
     psutil
+    py3langid
     python-dateutil
     scipy
     toml
diff --git a/pkgs/development/tools/gauge/default.nix b/pkgs/development/tools/gauge/default.nix
index 9c9c53c39073..456e5f8ad721 100644
--- a/pkgs/development/tools/gauge/default.nix
+++ b/pkgs/development/tools/gauge/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "gauge";
-  version = "1.6.6";
+  version = "1.6.7";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -14,10 +14,10 @@ buildGoModule rec {
     owner = "getgauge";
     repo = "gauge";
     rev = "v${version}";
-    hash = "sha256-u64LEDWktnBqGmey1TGdpVerjBsgyyRKJKeAJU3ysZs=";
+    hash = "sha256-+6b34nCuoBGd9v9eoAgthxYboGWDM8rCU56VXpVKdQc=";
   };
 
-  vendorHash = "sha256-RC3oS4nD291p8BSiWZUmsej/XuadaR7Xz1+bEfZL3Oc=";
+  vendorHash = "sha256-VVHsldLfLrdufSBLbgSlniYK1+64651DL8gzw5VHans=";
 
   excludedPackages = [ "build" "man" ];
 
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
index 60e67e17a86e..1c3355f3aef4 100644
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.17.2";
+  version = "2.17.3";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-StvESO3kFo+mgiJgx7JvZzBnT62zT3ZxxWVjnVBTLlg=";
+    sha256 = "sha256-JIKEuYhzX/gTO2YYI3u1I9YBbXGkdmoQ3kiSfTwu/Qg=";
   };
   vendorHash = "sha256-qLyqG7A4TEsZSF8olXWc2BIYZukQx/xHsnbYTfC/w4A=";
 
diff --git a/pkgs/development/tools/goresym/default.nix b/pkgs/development/tools/goresym/default.nix
index 9612b25254f5..d20a9a6c809a 100644
--- a/pkgs/development/tools/goresym/default.nix
+++ b/pkgs/development/tools/goresym/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "goresym";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchFromGitHub {
     owner = "mandiant";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-U3AjEKQKPS5ghrmEJTsGRIC2BoPYAWL6RDPhA+eN2hg=";
+    sha256 = "sha256-qFDacInIiV1thuYMjyzTG7ru5bkd2Af1iao7Oes1mRg=";
   };
 
   subPackages = [ "." ];
diff --git a/pkgs/development/tools/language-servers/csharp-ls/default.nix b/pkgs/development/tools/language-servers/csharp-ls/default.nix
index dd8643b7cd94..eb8c6cd2bb31 100644
--- a/pkgs/development/tools/language-servers/csharp-ls/default.nix
+++ b/pkgs/development/tools/language-servers/csharp-ls/default.nix
@@ -8,9 +8,9 @@ in
 
 buildDotnetGlobalTool rec {
   pname = "csharp-ls";
-  version = "0.12.0";
+  version = "0.13.0";
 
-  nugetSha256 = "sha256-JQPIFgVisw/rRUcWpRGrFI3S67f5mOl0CWG1i8BlsXQ=";
+  nugetSha256 = "sha256-hhgMwDk3mT7E07REqZduTuEnS7D1tCgdxqN+MLNo9EI=";
 
   dotnet-sdk = sdk_8_0;
   dotnet-runtime = sdk_8_0;
diff --git a/pkgs/development/tools/rust/cargo-deb/default.nix b/pkgs/development/tools/rust/cargo-deb/default.nix
index 236fd2f3e025..81f49e6b40d6 100644
--- a/pkgs/development/tools/rust/cargo-deb/default.nix
+++ b/pkgs/development/tools/rust/cargo-deb/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FIBMwLgLLgf6m/ciSlYiQ46HHf1ux0QY4RkoidlaEjs=";
+    hash = "sha256-KVHci8h30cAZZffRA3e0gb1uAMv2UDiC9HkiqNaqSS4=";
   };
 
-  cargoHash = "sha256-MmHwaodr/FLxCucfCkV/Cuflyu8902kpEPuTCKkchNU=";
+  cargoHash = "sha256-swRiR+YeQVT7mMzJHQtCI4wcG9z44r34YDv8WmEPr08=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/games/colobot/default.nix b/pkgs/games/colobot/default.nix
index e1070843811c..aa4de1c7ec54 100644
--- a/pkgs/games/colobot/default.nix
+++ b/pkgs/games/colobot/default.nix
@@ -18,6 +18,19 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Nu7NyicNIk5yza9sXfd4KbGdB65guVuGREd6rwRU3lU=";
   };
 
+  patches = [
+    # https://github.com/colobot/colobot/pull/1559
+    # gcc13 fixes. remove on next update
+    (fetchpatch {
+      name = "gcc13-fixes.patch";
+      url = "https://github.com/colobot/colobot/commit/d47e26586325ec11425cef5c95fc206dc103dbe2.patch";
+      hash = "sha256-2DmLkyoyiZSW0yeZDSSWFjCEJos25jPHZQi1yuJGFko=";
+      excludes = [
+        "src/object/task/taskgoto.h"
+      ];
+    })
+  ];
+
   nativeBuildInputs = [ cmake xmlstarlet doxygen python3 ];
   buildInputs = [ boost SDL2 SDL2_image SDL2_ttf libpng glew gettext libsndfile libvorbis libogg physfs openal ];
 
diff --git a/pkgs/os-specific/linux/ddcci/default.nix b/pkgs/os-specific/linux/ddcci/default.nix
index ce435b3874f3..4d1c9bd93558 100644
--- a/pkgs/os-specific/linux/ddcci/default.nix
+++ b/pkgs/os-specific/linux/ddcci/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, kernel }:
+{ lib, stdenv, fetchFromGitLab, kernel, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ddcci-driver";
@@ -12,6 +12,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-4pCfXJcteWwU6cK8OOSph4XlhKTk289QqLxsSWY7cac=";
   };
 
+  patches = [
+    # See https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/merge_requests/15
+    (fetchpatch {
+      name = "fix-build-with-linux68.patch";
+      url = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/commit/3eb20df68a545d07b8501f13fa9d20e9c6f577ed.patch";
+      hash = "sha256-Y1ktYaJTd9DtT/mwDqtjt/YasW9cVm0wI43wsQhl7Bg=";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -36,7 +45,7 @@ stdenv.mkDerivation rec {
     description = "Kernel module driver for DDC/CI monitors";
     homepage = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ kiike ];
     platforms = platforms.linux;
     broken = kernel.kernelOlder "5.1";
   };
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 8b54a1f9a745..2cf5243422e1 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    hash = "sha256-4Im3YWhLs5Q+o4DtpSuSMuKtKqXaICL9/EB0q5um6mQ=";
+    hash = "sha256-US1jw0XK1BcP037XPhttzBloDU62m4BVSIbsGs9LaJU=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
       --replace "/usr/local" "$out"
   '';
 
-  vendorHash = "sha256-APW0XM6fTQOCw4tE1NA5VNN3fBUmsvn99NqqJnB3Q0s=";
+  vendorHash = "sha256-FuVWV3Rimhd+Pm9wrKGLWQWtbP1hWvoWa22pQT+m2go=";
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c213bd4e6ffe..cf38897c5070 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -871,12 +871,14 @@ let
     };
 
     zram = {
-      ZRAM            = module;
-      ZRAM_WRITEBACK  = option yes;
-      ZRAM_MULTI_COMP = whenAtLeast "6.2" yes;
-      ZSWAP           = option yes;
-      ZPOOL           = yes;
-      ZBUD            = option yes;
+      ZRAM                          = module;
+      ZRAM_WRITEBACK                = option yes;
+      ZRAM_MULTI_COMP               = whenAtLeast "6.2" yes;
+      ZRAM_DEF_COMP_ZSTD            = whenAtLeast "5.11" yes;
+      ZSWAP                         = option yes;
+      ZSWAP_COMPRESSOR_DEFAULT_ZSTD = whenAtLeast "5.7" yes;
+      ZPOOL                         = yes;
+      ZSMALLOC                      = option yes;
     };
 
     brcmfmac = {
@@ -948,8 +950,9 @@ let
       THRUSTMASTER_FF    = yes;
       ZEROPLUS_FF        = yes;
 
-      MODULE_COMPRESS    = whenOlder "5.13" yes;
-      MODULE_COMPRESS_XZ = yes;
+      MODULE_COMPRESS      = whenOlder "5.13" yes;
+      MODULE_COMPRESS_XZ   = whenOlder "5.13" yes;
+      MODULE_COMPRESS_ZSTD = whenAtLeast "5.13" yes;
 
       SYSVIPC            = yes;  # System-V IPC
 
@@ -1124,6 +1127,7 @@ let
       FW_LOADER_USER_HELPER_FALLBACK = option no;
 
       FW_LOADER_COMPRESS = whenAtLeast "5.3" yes;
+      FW_LOADER_COMPRESS_ZSTD = whenAtLeast "5.19" yes;
 
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
diff --git a/pkgs/servers/caddy/xcaddy/default.nix b/pkgs/servers/caddy/xcaddy/default.nix
index c90ef853b065..69a531c70767 100644
--- a/pkgs/servers/caddy/xcaddy/default.nix
+++ b/pkgs/servers/caddy/xcaddy/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "xcaddy";
-  version = "0.4.0";
+  version = "0.4.1";
 
   subPackages = [ "cmd/xcaddy" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "caddyserver";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wzX6+O7hN8x3DDkTdNMBuWTCY8dp1gGrF2TW1d07PEc=";
+    hash = "sha256-xEPSRKrQC9hb+G9/rV9/k4btvZxXZkcsxmaxWcgl2fk=";
   };
 
   patches = [
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index acfcf038f20e..e090ac338513 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -32,6 +32,8 @@
 
   moonraker = callPackage ./moonraker {};
 
+  ntfy = callPackage ./ntfy {};
+
   omnik_inverter = callPackage ./omnik_inverter {};
 
   prometheus_sensor = callPackage ./prometheus_sensor {};
diff --git a/pkgs/servers/home-assistant/custom-components/ntfy/default.nix b/pkgs/servers/home-assistant/custom-components/ntfy/default.nix
new file mode 100644
index 000000000000..65ac5bff7d1e
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/ntfy/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, fetchFromGitHub
+, buildHomeAssistantComponent
+, requests
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "hbrennhaeuser";
+  domain = "ntfy";
+  version = "v1.0.2";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "homeassistant_integration_ntfy";
+    rev = "refs/tags/${version}";
+    hash = "sha256-QBk2k0v/yV8BEf/lgIye+XhLMwvzSDlSewsR+eGXKyU=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  meta = with lib; {
+    description = "Send notifications with ntfy.sh and selfhosted ntfy-servers";
+    homepage = "https://github.com/hbrennhaeuser/homeassistant_integration_ntfy";
+    maintainers = with maintainers; [ koral ];
+    license = licenses.gpl3;
+  };
+}
+
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index 463f7e85e7ea..88df64b7d2d6 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -38,13 +38,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-UzMVJnXYLy7E9RuM4VPdqnIyfQjDOdAlKiqRkXuxnQ0=";
+    sha256 = "sha256-IG/UpTaeKTXdYIR++BZA7+bMRW4NWQUo9PxsEnqPuB4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/networking/curl-impersonate/default.nix b/pkgs/tools/networking/curl-impersonate/default.nix
index be9f3f61df1c..2ea3ac6a09a2 100644
--- a/pkgs/tools/networking/curl-impersonate/default.nix
+++ b/pkgs/tools/networking/curl-impersonate/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , callPackage
 , buildGoModule
 , installShellFiles
@@ -41,6 +42,12 @@ let
       # Fix shebangs in the NSS build script
       # (can't just patchShebangs since makefile unpacks it)
       ./curl-impersonate-0.5.2-fix-shebangs.patch
+
+      # SOCKS5 heap buffer overflow - https://curl.se/docs/CVE-2023-38545.html
+      (fetchpatch {
+        url = "https://github.com/lwthiker/curl-impersonate/commit/e7b90a0d9c61b6954aca27d346750240e8b6644e.patch";
+        hash = "sha256-jFrz4Q+MJGfNmwwzHhThado4c9hTd/+b/bfRsr3FW5k=";
+      })
     ];
 
     # Disable blanket -Werror to fix build on `gcc-13` related to minor
@@ -159,12 +166,6 @@ let
       license = with licenses; [ curl mit ];
       maintainers = with maintainers; [ deliciouslytyped lilyinstarlight ];
       platforms = platforms.unix;
-      knownVulnerabilities = [
-        "CVE-2023-38545"  # SOCKS5 heap buffer overflow - https://curl.se/docs/CVE-2023-38545.html
-        "CVE-2023-32001"  # fopen TOCTOU race condition - https://curl.se/docs/CVE-2023-32001.html
-        "CVE-2022-43551"  # HSTS bypass - https://curl.se/docs/CVE-2022-43551.html
-        "CVE-2022-42916"  # HSTS bypass - https://curl.se/docs/CVE-2022-42916.html
-      ];
     };
   };
 in
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 89b200e8e563..bfe968456a2d 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   postInstall = lib.optionalString withCyrusSaslXoauth2 ''
     wrapProgram "$out/bin/mbsync" \
-        --prefix SASL_PATH : "${lib.makeSearchPath "lib/sasl2" [ cyrus-sasl-xoauth2 ]}"
+        --prefix SASL_PATH : "${lib.makeSearchPath "lib/sasl2" [ cyrus-sasl-xoauth2 cyrus_sasl.out ]}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/spire/default.nix b/pkgs/tools/security/spire/default.nix
index 9bc7e92a4cfe..236710eb0eba 100644
--- a/pkgs/tools/security/spire/default.nix
+++ b/pkgs/tools/security/spire/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "spire";
-  version = "1.9.4";
+  version = "1.9.5";
 
   outputs = [ "out" "agent" "server" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "spiffe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QRLfxTMkoO37ieXtfEvOsS4naR8bvBS4VFOM9lY4rT0=";
+    sha256 = "sha256-cn7ipY5dKcKSUTqOAqOf9KgdufMnk58WW4to9MfRL7g=";
   };
 
   vendorHash = "sha256-XWfo6NbADVRaMuemTrDgF2LQSpIe037z8el2CVzOJHI=";
diff --git a/pkgs/tools/system/throttled/default.nix b/pkgs/tools/system/throttled/default.nix
index f09c0480865f..ff671633b960 100644
--- a/pkgs/tools/system/throttled/default.nix
+++ b/pkgs/tools/system/throttled/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, pciutils }:
+{ lib, stdenv, fetchFromGitHub, gobject-introspection, python3Packages, pciutils, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "throttled";
@@ -11,7 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-0MsPp6y4r/uZB2SplKV+SAiJoxIs2jgOQmQoQQ2ZKwI=";
   };
 
-  nativeBuildInputs = [ python3Packages.wrapPython ];
+  nativeBuildInputs = [
+    gobject-introspection
+    python3Packages.wrapPython
+    wrapGAppsHook3
+  ];
 
   pythonPath = with python3Packages; [
     configparser
@@ -35,6 +39,12 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   postFixup = "wrapPythonPrograms";
 
   meta = with lib; {
diff --git a/pkgs/tools/text/riffdiff/default.nix b/pkgs/tools/text/riffdiff/default.nix
index 1db7967d0f57..cd7008f0d5b0 100644
--- a/pkgs/tools/text/riffdiff/default.nix
+++ b/pkgs/tools/text/riffdiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "riffdiff";
-  version = "3.1.0";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "riff";
     rev = version;
-    hash = "sha256-ASIB7+ZyvMsaRdvJcWT/sR0JLyt4v/gytAIi8Yajlzg=";
+    hash = "sha256-wBLVH4Yrvj3rU5tRaxV8BBWkR2xLMxjkwjJ4rf1hHXk=";
   };
 
-  cargoHash = "sha256-NGTWBlg5xvodK02RtFuCe7KsFm4z2aEpbcx3UqH9G/o=";
+  cargoHash = "sha256-4qskpcDE9l+7KjcVRou4GcdG7aF8stKXK12WBy81UBw=";
 
   meta = with lib; {
     description = "A diff filter highlighting which line parts have changed";
diff --git a/pkgs/tools/text/rust-petname/default.nix b/pkgs/tools/text/rust-petname/default.nix
index 67ce03e822b9..3abc8a0210f6 100644
--- a/pkgs/tools/text/rust-petname/default.nix
+++ b/pkgs/tools/text/rust-petname/default.nix
@@ -2,15 +2,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-petname";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchCrate {
     inherit version;
     crateName = "petname";
-    sha256 = "sha256-n/oqQCshxcqQPYNI0GZXGdZmx0Y12l6QKQpsbThdNAA=";
+    sha256 = "sha256-KP+GdGlwLHcKE8nAmFr2wHbt5RD9Ptpiz1X5HgJ6BgU=";
   };
 
-  cargoHash = "sha256-Rzhp+lS0ykJsMdd2Z+oTWjFFWGp+ZX0Cup7Hq2bIbrg=";
+  cargoHash = "sha256-R1Xahr9R4G8Tr2cGRJ2oydVaLohPz2VM6tnbtE8Hysk=";
 
   meta = with lib; {
     description = "Generate human readable random names";
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index e2e244ceda69..4b53c6d6def7 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-04-18";
+  version = "0-unstable-2024-04-30";
 
   nativeBuildInputs = [
     makeWrapper
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "62b2b5913420d92bb2863d9c92ac2072f7aaa5f9";
-    hash = "sha256-kVGRuFVkJvQfl1bEjBU0pyx+SB+k5yI9C6XFiKZRpLQ=";
+    rev = "a5241c3ac27eb5eda01bd58b6370982a64320106";
+    hash = "sha256-2RvbIFfYQQSsrXJ72q5LWyaCLCZvThTi7YuiOaJR9mE=";
   };
 
   buildFlags = [ "texpresso" ];
diff --git a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
index 070594349ad7..838a51324a09 100644
--- a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
@@ -6,8 +6,8 @@ tectonic-unwrapped.override (old: {
       src = fetchFromGitHub {
         owner = "let-def";
         repo = "tectonic";
-        rev = "7729f1360a7e1e8b8a9f8a6a23f96b5f7cc023d0";
-        hash = "sha256-OyVkA2EuejxpQvA6pOuFaZh8ghZZ3HaV9q5DZ/2sIrY=";
+        rev = "b38cb3b2529bba947d520ac29fbb7873409bd270";
+        hash = "sha256-ap7fEPHsASAphIQkjcvk1CC7egTdxaUh7IpSS5os4W8=";
         fetchSubmodules = true;
       };
       cargoHash = "sha256-62sxvPIiY3len1wsl7QelK3u4ekftIjcTqoIGZMYb5A=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bbd967b61cc7..d3a033f6f67a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1302,7 +1302,9 @@ with pkgs;
 
   makeBinaryWrapper = callPackage ../build-support/setup-hooks/make-binary-wrapper { };
 
-  compressFirmwareXz = callPackage ../build-support/kernel/compress-firmware-xz.nix { };
+  compressFirmwareXz = callPackage ../build-support/kernel/compress-firmware.nix { type = "xz"; };
+
+  compressFirmwareZstd = callPackage ../build-support/kernel/compress-firmware.nix { type = "zstd"; };
 
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
     callPackage ../build-support/kernel/modules-closure.nix {
@@ -30137,6 +30139,8 @@ with pkgs;
 
   clight = callPackage ../applications/misc/clight { };
 
+  clight-gui = libsForQt5.callPackage ../applications/misc/clight/clight-gui.nix { };
+
   clightd = callPackage ../applications/misc/clight/clightd.nix { };
 
   clipgrab = libsForQt5.callPackage ../applications/video/clipgrab { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 01a60ecf5ba0..b2ff7f66ea21 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3418,6 +3418,8 @@ self: super: with self; {
 
   dmenu-python = callPackage ../development/python-modules/dmenu { };
 
+  dm-control = callPackage ../development/python-modules/dm-control { };
+
   dm-env = callPackage ../development/python-modules/dm-env { };
 
   dm-haiku = callPackage ../development/python-modules/dm-haiku { };
@@ -5913,7 +5915,9 @@ self: super: with self; {
 
   isbnlib = callPackage ../development/python-modules/isbnlib { };
 
-  islpy = callPackage ../development/python-modules/islpy { };
+  islpy = callPackage ../development/python-modules/islpy {
+    isl = pkgs.isl_0_24;
+  };
 
   iso3166 = callPackage ../development/python-modules/iso3166 { };
 
@@ -8858,6 +8862,8 @@ self: super: with self; {
 
   nose-warnings-filters = callPackage ../development/python-modules/nose-warnings-filters { };
 
+  nose-xunitmp = callPackage ../development/python-modules/nose-xunitmp { };
+
   nosexcover = callPackage ../development/python-modules/nosexcover { };
 
   notebook = callPackage ../development/python-modules/notebook { };
@@ -13137,6 +13143,8 @@ self: super: with self; {
 
   reportlab = callPackage ../development/python-modules/reportlab { };
 
+  reportlab-qrcode = callPackage ../development/python-modules/reportlab-qrcode { };
+
   repoze-lru = callPackage ../development/python-modules/repoze-lru { };
 
   repoze-sphinx-autointerface = callPackage ../development/python-modules/repoze-sphinx-autointerface { };
@@ -13833,6 +13841,8 @@ self: super: with self; {
     inherit (pkgs) cmake llvmPackages;
   });
 
+  shimmy = callPackage ../development/python-modules/shimmy { };
+
   shippai = callPackage ../development/python-modules/shippai { };
 
   shiv = callPackage ../development/python-modules/shiv { };