diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index dceb843ac72b..00e4efc9f7e6 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    hash = "sha256-CaDGl8+gIbcUH+bxqye+XEFO7ZwFE7NGZmyrqn7vzTk=";
+    hash = "sha256-1/X8HuhzizrkiOyCZ7F6rq6G33oqVaf4uW9Sr94ogL8=";
   };
 
-  vendorHash = "sha256-8f37IPO9PsYA/oHCtIjVrUgOTkXzkHv4cGTy5bUQP8s=";
+  vendorHash = "sha256-2b/c6t9RkHbBe894DPOETLMf4MpsTjXMtEoVG4FMo24=";
 
   subPackages = ["cmd"];
 
diff --git a/pkgs/applications/networking/cluster/kuma/default.nix b/pkgs/applications/networking/cluster/kuma/default.nix
index 633c7df45c8c..1351b9fe7051 100644
--- a/pkgs/applications/networking/cluster/kuma/default.nix
+++ b/pkgs/applications/networking/cluster/kuma/default.nix
@@ -15,14 +15,14 @@
 
 buildGoModule rec {
   inherit pname;
-  version = "2.8.1";
+  version = "2.8.2";
   tags = lib.optionals enableGateway [ "gateway" ];
 
   src = fetchFromGitHub {
     owner = "kumahq";
     repo = "kuma";
     rev = version;
-    hash = "sha256-k4XqFwpHlm6BmFORqc1IFGqbfLYqtHwLM2eSF3JV+0M=";
+    hash = "sha256-znjOMegh0lgFDonUXtRfs+1ZMN5Olzz01E2tX+tRcns=";
   };
 
   vendorHash = "sha256-FEdDOpz6C89OlzU3Pl4Uu6P0WgM4QsuccQ9vAHnb4xI=";
diff --git a/pkgs/applications/networking/cluster/rke/default.nix b/pkgs/applications/networking/cluster/rke/default.nix
index cea0610f144e..3f44a9cff710 100644
--- a/pkgs/applications/networking/cluster/rke/default.nix
+++ b/pkgs/applications/networking/cluster/rke/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "rke";
-  version = "1.5.10";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-e4YR3vYpaRVhwvBY8VwLp3XNXxnwYlS14VP0gSyLvJA=";
+    hash = "sha256-ZxNU76W7IGSn1cdzmiLI/eMO3dAd8bUQX+1cvANci2k=";
   };
 
-  vendorHash = "sha256-++4d87ARL1czjL9I/AuodIP2PmbjjAQ5jf5x2bP16yQ=";
+  vendorHash = "sha256-Rr2BXCpliv9KF9wkXQLy6LxKxyPo1pO5SHUTcy2wETM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/firewalld/default.nix b/pkgs/applications/networking/firewalld/default.nix
index 308fd0c2e5af..1ea6f2f8d593 100644
--- a/pkgs/applications/networking/firewalld/default.nix
+++ b/pkgs/applications/networking/firewalld/default.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "firewalld";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "firewalld";
     repo = "firewalld";
     rev = "v${version}";
-    sha256 = "sha256-MaBYJLNVlDEsMlnyNtf8G8D1Tnvcfv0/bXQ/8f7kBao=";
+    sha256 = "sha256-VI1LyedohInmZb7heNoZ/4cvLz5IImEE2tyNylvr2mU=";
   };
 
   patches = [
diff --git a/pkgs/applications/terminal-emulators/hyper/default.nix b/pkgs/applications/terminal-emulators/hyper/default.nix
index 8fcbbe0666ef..4db56792b733 100644
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@@ -54,5 +54,6 @@ stdenv.mkDerivation rec {
     license     = licenses.mit;
     platforms   = [ "x86_64-linux" ];
     mainProgram = "hyper";
+    broken = true; # Error: 'node-pty' failed to load
   };
 }
diff --git a/pkgs/applications/version-management/git-subrepo/default.nix b/pkgs/applications/version-management/git-subrepo/default.nix
index e861bc17b8ca..29da4ee6be8b 100644
--- a/pkgs/applications/version-management/git-subrepo/default.nix
+++ b/pkgs/applications/version-management/git-subrepo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-subrepo";
-  version = "0.4.6";
+  version = "0.4.9";
 
   src = fetchFromGitHub {
     owner = "ingydotnet";
     repo = "git-subrepo";
     rev = version;
-    sha256 = "sha256-83N0Ek6DawUrOc6s2Utzi8776bX4UTGS/a/OffkV44Y=";
+    sha256 = "sha256-Fwh4haGXVDsLexe/1kjUhY4lF6u5cTrAwivZiOkPig0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index 19ffd92db818..cddad036d68e 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.14.0";
+  version = "2.18.0";
 
   src = fetchurl {
       url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-3I4WSdWfPZd//pJiYXKcgpjx8qv4nSeMHHGJE1ja00o=";
+      hash = "sha256-no05QZpvaF7Kn9lU26lXjimHJn7xHydmh7Rv50aXPm4=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix b/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
index 608a02d70bf0..1351611e7e7b 100644
--- a/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
+++ b/pkgs/by-name/ar/arxiv-latex-cleaner/package.nix
@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "arxiv-latex-cleaner";
-  version = "1.0.6";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "google-research";
     repo = "arxiv-latex-cleaner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-S/r5riFIsRG+5za+4kVvUXOLIJ3ELCDWlSpYeSuNs+s=";
+    hash = "sha256-CQb1u1j+/px+vNqA3iXZ2oe6/0ZWeMjWrUQL9elRDEI=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/ce/cewler/package.nix b/pkgs/by-name/ce/cewler/package.nix
index d0a4a2b15dea..f4f96039b9f6 100644
--- a/pkgs/by-name/ce/cewler/package.nix
+++ b/pkgs/by-name/ce/cewler/package.nix
@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "roys";
     repo = "cewler";
     rev = "v${version}";
-    hash = "sha256-nlF+B7Z1GRo3ZrGhG58c0vLcJAW+PvXT2tfFoyElw7w=";
+    hash = "sha256-lVI3p6YMugQ3yKHFNxISmUY7XZMuX/TXvVUoZfIeJog=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/ga/gabutdm/package.nix b/pkgs/by-name/ga/gabutdm/package.nix
index 32da32be0361..9c2e57eb119e 100644
--- a/pkgs/by-name/ga/gabutdm/package.nix
+++ b/pkgs/by-name/ga/gabutdm/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gabutdm";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "gabutakut";
     repo = "gabutdm";
     rev = version;
-    hash = "sha256-0PBNKacgKT5xcd0mnn0y9ltmxEAbP+S7MLtt/Zau8vs=";
+    hash = "sha256-FKOgoJ0QreYk3PgvUoQMczC3tXkthw86/Y3pnm6tTQk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/im/imgbrd-grabber/package.nix b/pkgs/by-name/im/imgbrd-grabber/package.nix
index a3f083633bbe..5714ae5c109c 100644
--- a/pkgs/by-name/im/imgbrd-grabber/package.nix
+++ b/pkgs/by-name/im/imgbrd-grabber/package.nix
@@ -62,6 +62,9 @@ stdenv.mkDerivation (finalAttrs: {
     # ensure the script uses the rsync package from nixpkgs
     substituteInPlace ../scripts/package.sh --replace-fail "rsync" "${lib.getExe rsync}"
 
+    substituteInPlace gui/CMakeLists.txt \
+      --replace-fail "find_package(Qt6 COMPONENTS " "find_package(Qt6 COMPONENTS NetworkAuth " \
+      --replace-fail "set(QT_LIBRARIES " "set(QT_LIBRARIES Qt6::NetworkAuth "
 
     # the npm build step only runs typescript
     # run this step directly so it doesn't try and fail to download the unnecessary node_modules, etc.
diff --git a/pkgs/by-name/ma/maccy/package.nix b/pkgs/by-name/ma/maccy/package.nix
index 6e3821d7b7cf..5aa00fd52651 100644
--- a/pkgs/by-name/ma/maccy/package.nix
+++ b/pkgs/by-name/ma/maccy/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "maccy";
-  version = "0.28.0";
+  version = "0.31.0";
 
   src = fetchurl {
     url = "https://github.com/p0deje/Maccy/releases/download/${finalAttrs.version}/Maccy.app.zip";
-    hash = "sha256-dxjt5skIHN6VlkWpcmj+ZSovVARuQETKoyKMkMtUhHQ=";
+    hash = "sha256-vjfFtlX0b3howUc2bTR/pqXwnzjXpK6qPR8+81sANTs=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/my/myanon/package.nix b/pkgs/by-name/my/myanon/package.nix
index c1f61dbff333..3ac096267e6d 100644
--- a/pkgs/by-name/my/myanon/package.nix
+++ b/pkgs/by-name/my/myanon/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "myanon";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "ppomes";
     repo = "myanon";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-tTGr8bTxZc75GYhpJ0uzpkPtMB3r/DXRMNqSlG+1eaA=";
+    hash = "sha256-sB6ykRywaoG2gfHOEQ9UoVn62nMciBWgCM9DhovBoe0=";
   };
 
   nativeBuildInputs = [ autoreconfHook flex bison ];
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/by-name/op/open-vm-tools/package.nix
similarity index 68%
rename from pkgs/applications/virtualization/open-vm-tools/default.nix
rename to pkgs/by-name/op/open-vm-tools/package.nix
index 63abcad60a5d..d660cd64bb34 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/by-name/op/open-vm-tools/package.nix
@@ -1,42 +1,43 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, makeWrapper
-, autoreconfHook
-, bash
-, fuse3
-, libmspack
-, openssl
-, pam
-, xercesc
-, icu
-, libdnet
-, procps
-, libtirpc
-, rpcsvc-proto
-, libX11
-, libXext
-, libXinerama
-, libXi
-, libXrender
-, libXrandr
-, libXtst
-, libxcrypt
-, libxml2
-, pkg-config
-, glib
-, gdk-pixbuf-xlib
-, gtk3
-, gtkmm3
-, iproute2
-, dbus
-, systemd
-, which
-, libdrm
-, udev
-, util-linux
-, xmlsec
-, withX ? true
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  autoreconfHook,
+  bash,
+  fuse3,
+  libmspack,
+  openssl,
+  pam,
+  xercesc,
+  icu,
+  libdnet,
+  procps,
+  libtirpc,
+  rpcsvc-proto,
+  libX11,
+  libXext,
+  libXinerama,
+  libXi,
+  libXrender,
+  libXrandr,
+  libXtst,
+  libxcrypt,
+  libxml2,
+  pkg-config,
+  glib,
+  gdk-pixbuf-xlib,
+  gtk3,
+  gtkmm3,
+  iproute2,
+  dbus,
+  systemd,
+  which,
+  libdrm,
+  udev,
+  util-linux,
+  xmlsec,
+  withX ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -52,7 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/open-vm-tools";
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   nativeBuildInputs = [
     autoreconfHook
@@ -60,35 +64,37 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    fuse3
-    glib
-    icu
-    libdnet
-    libdrm
-    libmspack
-    libtirpc
-    libxcrypt
-    libxml2
-    openssl
-    pam
-    procps
-    rpcsvc-proto
-    udev
-    xercesc
-    xmlsec
-  ] ++ lib.optionals withX [
-    gdk-pixbuf-xlib
-    gtk3
-    gtkmm3
-    libX11
-    libXext
-    libXinerama
-    libXi
-    libXrender
-    libXrandr
-    libXtst
-  ];
+  buildInputs =
+    [
+      fuse3
+      glib
+      icu
+      libdnet
+      libdrm
+      libmspack
+      libtirpc
+      libxcrypt
+      libxml2
+      openssl
+      pam
+      procps
+      rpcsvc-proto
+      udev
+      xercesc
+      xmlsec
+    ]
+    ++ lib.optionals withX [
+      gdk-pixbuf-xlib
+      gtk3
+      gtkmm3
+      libX11
+      libXext
+      libXinerama
+      libXi
+      libXrender
+      libXrandr
+      libXtst
+    ];
 
   postPatch = ''
     sed -i Makefile.am \
@@ -131,7 +137,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''
     wrapProgram "$out/etc/vmware-tools/scripts/vmware/network" \
-      --prefix PATH ':' "${lib.makeBinPath [ iproute2 dbus systemd which ]}"
+      --prefix PATH ':' "${
+        lib.makeBinPath [
+          iproute2
+          dbus
+          systemd
+          which
+        ]
+      }"
     substituteInPlace "$out/lib/udev/rules.d/99-vmware-scsi-udev.rules" --replace "/bin/sh" "${bash}/bin/sh"
   '';
 
@@ -144,7 +157,14 @@ stdenv.mkDerivation (finalAttrs: {
       better management of, and seamless user interactions with, guests.
     '';
     license = licenses.gpl2;
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ joamaki kjeremy ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+      "aarch64-linux"
+    ];
+    maintainers = with maintainers; [
+      joamaki
+      kjeremy
+    ];
   };
 })
diff --git a/pkgs/by-name/op/opshin/package.nix b/pkgs/by-name/op/opshin/package.nix
index 7a1a9801eb1f..bda3768ca1d7 100644
--- a/pkgs/by-name/op/opshin/package.nix
+++ b/pkgs/by-name/op/opshin/package.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "opshin";
-  version = "0.21.2";
+  version = "0.22.0";
 
   format = "pyproject";
 
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "OpShin";
     repo = "opshin";
     rev = version;
-    hash = "sha256-YBdYF04iKUwIZncqyEDalU+YN6/qwlx/vQDzZ19GaPU=";
+    hash = "sha256-ixA5D7Bm/tjYEFhqaJ4sKkCkqQZpDyrwfD/LgN6Y4Uo=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
index 6b15867215e9..dfd15033e83a 100644
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmoneta";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "pgmoneta";
     repo = "pgmoneta";
     rev = version;
-    hash = "sha256-366UdWw2lJ30LhPR4Q0Iym1BTcgauEwwsGzn6Wew9gk=";
+    hash = "sha256-HDFvU7TjOENFvBorn11ludy8QQb4/IC6hEyyzvrJ2lU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/so/sof-tools/package.nix b/pkgs/by-name/so/sof-tools/package.nix
index 179210da93e3..e7a591849f07 100644
--- a/pkgs/by-name/so/sof-tools/package.nix
+++ b/pkgs/by-name/so/sof-tools/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sof-tools";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "thesofproject";
     repo = "sof";
     rev = "v${version}";
-    hash = "sha256-AOBJtC40Lu1gWM8w/Vs/nc540bisg58m+qH16F1e6jY=";
+    hash = "sha256-VmP0z3q1P8LqQ+ELZGkI7lEXGiMYdAPvS8Lbwv6dUyk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/tl/tlrc/package.nix b/pkgs/by-name/tl/tlrc/package.nix
index 4faeff53e378..e0e46552352a 100644
--- a/pkgs/by-name/tl/tlrc/package.nix
+++ b/pkgs/by-name/tl/tlrc/package.nix
@@ -1,7 +1,9 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , rustPlatform
 , installShellFiles
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,6 +21,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
   postInstall = ''
     installManPage tldr.1
     installShellCompletion completions/{tldr.bash,_tldr,tldr.fish}
diff --git a/pkgs/by-name/vc/vcpkg-tool/package.nix b/pkgs/by-name/vc/vcpkg-tool/package.nix
index 97e0c22ada73..f21dfc76a69c 100644
--- a/pkgs/by-name/vc/vcpkg-tool/package.nix
+++ b/pkgs/by-name/vc/vcpkg-tool/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./change-lock-location.patch
+    ./read-bundle-info-from-root.patch
   ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/vc/vcpkg-tool/read-bundle-info-from-root.patch b/pkgs/by-name/vc/vcpkg-tool/read-bundle-info-from-root.patch
new file mode 100644
index 000000000000..cc9e3bc9ef9a
--- /dev/null
+++ b/pkgs/by-name/vc/vcpkg-tool/read-bundle-info-from-root.patch
@@ -0,0 +1,43 @@
+diff --git a/include/vcpkg/vcpkgpaths.h b/include/vcpkg/vcpkgpaths.h
+index 90fd4d09..ebc6342b 100644
+--- a/include/vcpkg/vcpkgpaths.h
++++ b/include/vcpkg/vcpkgpaths.h
+@@ -28,6 +28,8 @@
+ 
+ namespace vcpkg
+ {
++    Path exported_determine_root(const ReadOnlyFilesystem& fs, const Path& original_cwd, const VcpkgCmdArguments& args);
++
+     struct ToolsetArchOption
+     {
+         ZStringView name;
+diff --git a/src/vcpkg.cpp b/src/vcpkg.cpp
+index 2b62cb55..d7b8ead5 100644
+--- a/src/vcpkg.cpp
++++ b/src/vcpkg.cpp
+@@ -296,7 +296,8 @@ int main(const int argc, const char* const* const argv)
+         Debug::println("To include the environment variables in debug output, pass --debug-env");
+     }
+     args.check_feature_flag_consistency();
+-    const auto current_exe_path = get_exe_path_of_current_process();
++    const auto current_exe_path =
++        exported_determine_root(real_filesystem, real_filesystem.current_path(VCPKG_LINE_INFO), args) / "vcpkg";
+ 
+     bool to_enable_metrics = true;
+     {
+diff --git a/src/vcpkg/vcpkgpaths.cpp b/src/vcpkg/vcpkgpaths.cpp
+index 77e107f5..132050ba 100644
+--- a/src/vcpkg/vcpkgpaths.cpp
++++ b/src/vcpkg/vcpkgpaths.cpp
+@@ -518,6 +518,11 @@ namespace
+ 
+ namespace vcpkg
+ {
++    Path exported_determine_root(const ReadOnlyFilesystem& fs, const Path& original_cwd, const VcpkgCmdArguments& args)
++    {
++        return determine_root(fs, original_cwd, args);
++    }
++
+     Path InstalledPaths::listfile_path(const BinaryParagraph& pgh) const
+     {
+         return this->vcpkg_dir_info() / (pgh.fullstem() + ".list");
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index 24966edf4264..98c040af0d25 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -14,7 +14,24 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "microsoft";
     repo = "vcpkg";
     rev = finalAttrs.version;
-    hash = "sha256-HT7IcznN5W+Innzg0aeOvZnpVUTf/uJFlYflE91YJQA=";
+    hash = "sha256-WE+BeF9BYR9/Gmi60g6ApXsWQ2vch2N6XhH1A9HAHsc=";
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      VCPKG_BASELINE_COMMIT_SHA=$(git rev-parse --verify HEAD)
+      # We only needed the .git folder for that previous command, so we can safely delete it now.
+      # If we don’t delete it, then we might run into problems (see #8567).
+      rm -r .git
+      # Here's the code that Creates this json file in Visual Studio deployment and the code that reads it:
+      #   https://github.com/microsoft/vcpkg-tool/blob/f098d3e0aaa7e46ea84a1f7079586e1ec5af8ab5/vcpkg-init/mint-standalone-bundle.ps1#L21
+      #   https://github.com/microsoft/vcpkg-tool/blob/f098d3e0aaa7e46ea84a1f7079586e1ec5af8ab5/src/vcpkg/bundlesettings.cpp#L87
+      #
+      # Here's the code that we target with this setting. If we use embeddedsha combined with usegitregistry, vcpkg
+      # will checkout a remote instead of trying to do git operation in the vcpkg root
+      #   https://github.com/microsoft/vcpkg-tool/blob/d272c0d4f5175b26bd56c6109d4c4935b791a157/src/vcpkg/vcpkgpaths.cpp#L920
+      #   https://github.com/microsoft/vcpkg-tool/blob/d272c0d4f5175b26bd56c6109d4c4935b791a157/src/vcpkg/configuration.cpp#L718
+      echo '{ "readonly": true, "usegitregistry": true, "deployment": "Git", "embeddedsha": "'"$VCPKG_BASELINE_COMMIT_SHA"'" }' > vcpkg-bundle.json
+    '';
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -36,7 +53,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       runHook preInstall
 
       mkdir -p "$out/bin" "$out/share/vcpkg/scripts/buildsystems"
-      cp --preserve=mode -r ./{docs,ports,triplets,scripts,.vcpkg-root,versions,LICENSE.txt} "$out/share/vcpkg/"
+      cp --preserve=mode -r ./{docs,ports,triplets,scripts,.vcpkg-root,versions,LICENSE.txt,vcpkg-bundle.json} "$out/share/vcpkg/"
 
       ${lib.optionalString doWrap ''
         makeWrapper "${vcpkg-tool}/bin/vcpkg" "$out/bin/vcpkg" \
@@ -50,7 +67,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     '';
 
   meta = {
-    description = "C++ Library Manager";
+    description = "C++ Library Manager for Windows, Linux, and macOS";
     mainProgram = "vcpkg";
     homepage = "https://vcpkg.io/";
     license = lib.licenses.mit;
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index 49df566c1871..bca96e3f87d0 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sudo-font";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchzip {
     url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-    hash = "sha256-PlsS+i/NcIMayDP6GVTDI+BLVgPSUdanlXQ8cCSXIzM=";
+    hash = "sha256-d0KOxINOw5G7V8c/hhgktHnSqeGNrE3Nd3ngSKSlBhc=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/c3c/default.nix b/pkgs/development/compilers/c3c/default.nix
index cbaac08ba6c8..6187b75cc874 100644
--- a/pkgs/development/compilers/c3c/default.nix
+++ b/pkgs/development/compilers/c3c/default.nix
@@ -19,7 +19,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     owner = "c3lang";
     repo = "c3c";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-iOljE1BRVc92NJZj+nr1G6KkBTCwJEUOadXHUDNoPGk=";
+    hash = "sha256-PKeQOVByNvhUq7QBhnNsl3LfR48MWhRC2rhiD58fVHY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index 1ec50ce87db3..e1f25fc8c0dc 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -89,9 +89,7 @@ let
         }
       );
     in
-    {
-      llef = callPackage ./lldb-plugins/llef.nix { };
-    }
+    lib.recurseIntoAttrs { llef = callPackage ./lldb-plugins/llef.nix { }; }
   );
 
   tools = lib.makeExtensible (
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 7a7ab3ffe30c..12d8f4d30a02 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -7,6 +7,7 @@
   stdenv,
   gcc12Stdenv,
   pkgs,
+  recurseIntoAttrs,
   # This is the default binutils, but with *this* version of LLD rather
   # than the default LLVM version's, if LLD is the choice. We use these for
   # the `useLLVM` bootstrapping below.
@@ -51,27 +52,29 @@ let
         args.name or (if (gitRelease != null) then "git" else lib.versions.major release_version);
     in
     lib.nameValuePair attrName (
-      callPackage ./common {
-        inherit (stdenvAdapters) overrideCC;
-        buildLlvmTools = buildPackages."llvmPackages_${attrName}".tools;
-        targetLlvmLibraries =
-          targetPackages."llvmPackages_${attrName}".libraries or llvmPackages."${attrName}".libraries;
-        targetLlvm = targetPackages."llvmPackages_${attrName}".llvm or llvmPackages."${attrName}".llvm;
-        stdenv =
-          if (lib.versions.major release_version == "13" && stdenv.cc.cc.isGNU or false) then
-            gcc12Stdenv
-          else
-            stdenv; # does not build with gcc13
-        inherit bootBintoolsNoLibc bootBintools;
-        inherit
-          officialRelease
-          gitRelease
-          monorepoSrc
-          version
-          ;
-      }
+      recurseIntoAttrs (
+        callPackage ./common {
+          inherit (stdenvAdapters) overrideCC;
+          buildLlvmTools = buildPackages."llvmPackages_${attrName}".tools;
+          targetLlvmLibraries =
+            targetPackages."llvmPackages_${attrName}".libraries or llvmPackages."${attrName}".libraries;
+          targetLlvm = targetPackages."llvmPackages_${attrName}".llvm or llvmPackages."${attrName}".llvm;
+          stdenv =
+            if (lib.versions.major release_version == "13" && stdenv.cc.cc.isGNU or false) then
+              gcc12Stdenv
+            else
+              stdenv; # does not build with gcc13
+          inherit bootBintoolsNoLibc bootBintools;
+          inherit
+            officialRelease
+            gitRelease
+            monorepoSrc
+            version
+            ;
+        }
+      )
     );
 
   llvmPackages = lib.mapAttrs' (version: args: mkPackage (args // { inherit version; })) versions;
 in
-llvmPackages
+llvmPackages // { inherit mkPackage; }
diff --git a/pkgs/development/compilers/typescript/default.nix b/pkgs/development/compilers/typescript/default.nix
index eb12388f84c0..9cf8cb530cda 100644
--- a/pkgs/development/compilers/typescript/default.nix
+++ b/pkgs/development/compilers/typescript/default.nix
@@ -2,20 +2,20 @@
 
 buildNpmPackage rec {
   pname = "typescript";
-  version = "5.5.3";
+  version = "5.5.4";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "TypeScript";
     rev = "v${version}";
-    hash = "sha256-2yfF14hR/avl67cOwo+Gr95w2jf+7KYlsMrlBTAKswM=";
+    hash = "sha256-U4lFR2SJQYqJYptVf3/QMD7ufa3r7Zm704gcwFKM/7s=";
   };
 
   patches = [
     ./disable-dprint-dstBundler.patch
   ];
 
-  npmDepsHash = "sha256-YihnUZgM+74EmImalyTFtp9xyiOOfjZVohDfpcvlSEg=";
+  npmDepsHash = "sha256-JYNFAOTN0WvYkr20J6tFM1KSIDTm1LlFw7w1bLkdg6k=";
 
   passthru.tests = {
     version = testers.testVersion {
diff --git a/pkgs/development/compilers/vyper/default.nix b/pkgs/development/compilers/vyper/default.nix
index b0a8b02ae49a..56899b6acba4 100644
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@@ -20,7 +20,7 @@ let
   sample-contract = writeText "example.vy" ''
     count: int128
 
-    @external
+    @deploy
     def __init__(foo: address):
         self.count = 1
   '';
@@ -28,14 +28,14 @@ let
 in
 buildPythonPackage rec {
   pname = "vyper";
-  version = "0.3.10";
+  version = "0.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jcH1AcqrQX+wzpxoppRFh/AUfsfMfTiJzzpFwZRm5Ik=";
+    hash = "sha256-locUXGoL9C3lLpIgLOmpE2SNPGV6yOXPubNaEA3EfjQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/cmark/default.nix b/pkgs/development/libraries/cmark/default.nix
index 5720f87c5bc4..a118ecf1adda 100644
--- a/pkgs/development/libraries/cmark/default.nix
+++ b/pkgs/development/libraries/cmark/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cmark";
-  version = "0.31.0";
+  version = "0.31.1";
 
   src = fetchFromGitHub {
     owner = "commonmark";
     repo = pname;
     rev = version;
-    sha256 = "sha256-GBesKTp9DqoFAmCc0RB+XePvzV9g+w+oyrD1nCgyklI=";
+    sha256 = "sha256-+JLw7zCjjozjq1RhRQGFqHj/MTUTq3t7A0V3T2U2PQk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index eddeb5e3ec4b..d47af97f191f 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -1,86 +1,101 @@
-/* This function builds just the `lib/locale/locale-archive' file from
-   Glibc and nothing else.  If `allLocales' is true, all supported
-   locales are included; otherwise, just the locales listed in
-   `locales'.  See localedata/SUPPORTED in the Glibc source tree for
-   the list of all supported locales:
-   https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED
+/*
+  This function builds just the `lib/locale/locale-archive' file from
+  Glibc and nothing else.  If `allLocales' is true, all supported
+  locales are included; otherwise, just the locales listed in
+  `locales'.  See localedata/SUPPORTED in the Glibc source tree for
+  the list of all supported locales:
+  https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED
 */
 
-{ lib, stdenv, buildPackages, callPackage, writeText, glibc
-, allLocales ? true, locales ? [ "en_US.UTF-8/UTF-8" ]
+{
+  lib,
+  stdenv,
+  buildPackages,
+  callPackage,
+  writeText,
+  glibc,
+  allLocales ? true,
+  locales ? [ "en_US.UTF-8/UTF-8" ],
+  linuxHeaders,
+  withLinuxHeaders ? !stdenv.cc.isGNU,
 }:
 
-(callPackage ./common.nix { inherit stdenv; } {
-  pname = "glibc-locales";
-  extraNativeBuildInputs = [ glibc ];
-}).overrideAttrs(finalAttrs: previousAttrs: {
+(callPackage ./common.nix
+  ({ inherit stdenv; } // lib.optionalAttrs withLinuxHeaders { inherit linuxHeaders; })
+  {
+    pname = "glibc-locales";
+    extraNativeBuildInputs = [ glibc ];
+    inherit withLinuxHeaders;
+  }
+).overrideAttrs
+  (
+    finalAttrs: previousAttrs: {
 
-  builder = ./locales-builder.sh;
+      builder = ./locales-builder.sh;
 
-  outputs = [ "out" ];
+      outputs = [ "out" ];
 
-  LOCALEDEF_FLAGS = [
-    (if stdenv.hostPlatform.isLittleEndian
-    then "--little-endian"
-    else "--big-endian")
-  ];
+      LOCALEDEF_FLAGS = [
+        (if stdenv.hostPlatform.isLittleEndian then "--little-endian" else "--big-endian")
+      ];
 
-  preBuild = (previousAttrs.preBuild or "") + ''
-      # Awful hack: `localedef' doesn't allow the path to `locale-archive'
-      # to be overriden, but you *can* specify a prefix, i.e. it will use
-      # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
-      # $TMPDIR as a prefix, meaning that the locale-archive is placed in
-      # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
-      LOCALEDEF_FLAGS+=" --prefix=$TMPDIR"
+      preBuild =
+        (previousAttrs.preBuild or "")
+        + ''
+          # Awful hack: `localedef' doesn't allow the path to `locale-archive'
+          # to be overriden, but you *can* specify a prefix, i.e. it will use
+          # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
+          # $TMPDIR as a prefix, meaning that the locale-archive is placed in
+          # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
+          LOCALEDEF_FLAGS+=" --prefix=$TMPDIR"
 
-      mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
+          mkdir -p $TMPDIR/"${buildPackages.glibc.out}/lib/locale"
 
-      echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
+          echo 'C.UTF-8/UTF-8 \' >> ../glibc-2*/localedata/SUPPORTED
 
-      # Hack to allow building of the locales (needed since glibc-2.12)
-      sed -i -e 's,^$(rtld-prefix) $(common-objpfx)locale/localedef,localedef $(LOCALEDEF_FLAGS),' ../glibc-2*/localedata/Makefile
-    ''
-      + lib.optionalString (!allLocales) ''
-      # Check that all locales to be built are supported
-      echo -n '${lib.concatMapStrings (s: s + " \\\n") locales}' \
-        | sort -u > locales-to-build.txt
-      cat ../glibc-2*/localedata/SUPPORTED | grep ' \\' \
-        | sort -u > locales-supported.txt
-      comm -13 locales-supported.txt locales-to-build.txt \
-        > locales-unsupported.txt
-      if [[ $(wc -c locales-unsupported.txt) != "0 locales-unsupported.txt" ]]; then
-        cat locales-supported.txt
-        echo "Error: unsupported locales detected:"
-        cat locales-unsupported.txt
-        echo "You should choose from the list above the error."
-        false
-      fi
+          # Hack to allow building of the locales (needed since glibc-2.12)
+          sed -i -e 's,^$(rtld-prefix) $(common-objpfx)locale/localedef,localedef $(LOCALEDEF_FLAGS),' ../glibc-2*/localedata/Makefile
+        ''
+        + lib.optionalString (!allLocales) ''
+          # Check that all locales to be built are supported
+          echo -n '${lib.concatMapStrings (s: s + " \\\n") locales}' \
+            | sort -u > locales-to-build.txt
+          cat ../glibc-2*/localedata/SUPPORTED | grep ' \\' \
+            | sort -u > locales-supported.txt
+          comm -13 locales-supported.txt locales-to-build.txt \
+            > locales-unsupported.txt
+          if [[ $(wc -c locales-unsupported.txt) != "0 locales-unsupported.txt" ]]; then
+            cat locales-supported.txt
+            echo "Error: unsupported locales detected:"
+            cat locales-unsupported.txt
+            echo "You should choose from the list above the error."
+            false
+          fi
 
-      echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
-    '';
+          echo SUPPORTED-LOCALES='${toString locales}' > ../glibc-2*/localedata/SUPPORTED
+        '';
 
-  # Current `nixpkgs` way of building locales is not compatible with
-  # parallel install. `locale-archive` is updated in parallel with
-  # multiple `localedef` processes and causes non-deterministic result:
-  #   https://github.com/NixOS/nixpkgs/issues/245360
-  enableParallelBuilding = false;
+      # Current `nixpkgs` way of building locales is not compatible with
+      # parallel install. `locale-archive` is updated in parallel with
+      # multiple `localedef` processes and causes non-deterministic result:
+      #   https://github.com/NixOS/nixpkgs/issues/245360
+      enableParallelBuilding = false;
 
-  makeFlags = (previousAttrs.makeFlags or []) ++ [
-    "localedata/install-locales"
-    "localedir=${builtins.placeholder "out"}/lib/locale"
-  ];
+      makeFlags = (previousAttrs.makeFlags or [ ]) ++ [
+        "localedata/install-locales"
+        "localedir=${builtins.placeholder "out"}/lib/locale"
+      ];
 
-  installPhase =
-    ''
-      mkdir -p "$out/lib/locale" "$out/share/i18n"
-      cp -v "$TMPDIR/$NIX_STORE/"*"/lib/locale/locale-archive" "$out/lib/locale"
-      cp -v ../glibc-2*/localedata/SUPPORTED "$out/share/i18n/SUPPORTED"
-    '';
+      installPhase = ''
+        mkdir -p "$out/lib/locale" "$out/share/i18n"
+        cp -v "$TMPDIR/$NIX_STORE/"*"/lib/locale/locale-archive" "$out/lib/locale"
+        cp -v ../glibc-2*/localedata/SUPPORTED "$out/share/i18n/SUPPORTED"
+      '';
 
-  setupHook = writeText "locales-setup-hook.sh"
-    ''
-      export LOCALE_ARCHIVE=@out@/lib/locale/locale-archive
-    '';
+      setupHook = writeText "locales-setup-hook.sh" ''
+        export LOCALE_ARCHIVE=@out@/lib/locale/locale-archive
+      '';
 
-  meta.description = "Locale information for the GNU C Library";
-})
+      meta.description = "Locale information for the GNU C Library";
+    }
+  )
diff --git a/pkgs/development/libraries/java/commons/daemon/default.nix b/pkgs/development/libraries/java/commons/daemon/default.nix
index 68b1c924214d..63cc3d41a0c3 100644
--- a/pkgs/development/libraries/java/commons/daemon/default.nix
+++ b/pkgs/development/libraries/java/commons/daemon/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.4";
+  version = "1.4.0";
   pname = "commons-daemon";
 
   src = fetchurl {
     url    = "mirror://apache/commons/daemon/binaries/commons-daemon-${version}-bin.tar.gz";
-    sha256 = "sha256-n9zmdPC4nLs/Rnth9uojkc5Kg5IfgERbr08TOvENR0Q=";
+    sha256 = "sha256-Cnsd15yREDtkoNFRAsIpACnChncVNgddTJ1CEvhKn48=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libivykis/default.nix b/pkgs/development/libraries/libivykis/default.nix
index fbf4f4b64808..52084508620c 100644
--- a/pkgs/development/libraries/libivykis/default.nix
+++ b/pkgs/development/libraries/libivykis/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   pname = "libivykis";
 
-  version = "0.42.4";
+  version = "0.43.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/libivykis/${version}/ivykis-${version}.tar.gz";
-    sha256 = "0abi0rc3wnncvr68hy6rmzp96x6napd7fs1mff20dr8lb0jyvy3f";
+    sha256 = "sha256-x9Kxi9k0Ln7f0T4OOKaNv+qm0x6S4+Z3K6o5Qp3+u58=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/development/libraries/nco/default.nix b/pkgs/development/libraries/nco/default.nix
index 708babff635d..885d6cd17ba1 100644
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nco";
-  version = "5.2.6";
+  version = "5.2.7";
 
   src = fetchFromGitHub {
     owner = "nco";
     repo = "nco";
     rev = finalAttrs.version;
-    hash = "sha256-v4kK1+tn/pgY2vz5BYzCBKfvLe5hti0ofUChUvQ++JU=";
+    hash = "sha256-RtjLCs+1HI2tJsSzMwoKq09teILvxFapZCxeZAZ4iCM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index f7320137d717..3201deab5029 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -5,7 +5,6 @@
   cmake,
   perl,
   stdenv,
-  gcc10,
   CoreFoundation,
   Security,
   pythonOlder,
@@ -28,13 +27,7 @@ buildPythonPackage rec {
     Security
   ];
 
-  # gcc <10 is not supported, LLVM on darwin is just fine
-  nativeBuildInputs =
-    [ cmake ]
-    ++ lib.optionals (!stdenv.isDarwin && stdenv.isAarch64) [
-      gcc10
-      perl
-    ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals (!stdenv.isDarwin) [ perl ];
 
   dontUseCmakeConfigure = true;
 
diff --git a/pkgs/development/python-modules/forecast-solar/default.nix b/pkgs/development/python-modules/forecast-solar/default.nix
index 8543662edbd7..8a955b514440 100644
--- a/pkgs/development/python-modules/forecast-solar/default.nix
+++ b/pkgs/development/python-modules/forecast-solar/default.nix
@@ -6,7 +6,6 @@
   pythonOlder,
   aiodns,
   aiohttp,
-  backports-zoneinfo,
   pytestCheckHook,
 }:
 
@@ -15,6 +14,8 @@ buildPythonPackage rec {
   version = "3.1.0";
   pyproject = true;
 
+  disabled = pythonOlder "3.11";
+
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "forecast_solar";
@@ -29,7 +30,7 @@ buildPythonPackage rec {
   dependencies = [
     aiodns
     aiohttp
-  ] ++ lib.optionals (pythonOlder "3.9") [ backports-zoneinfo ];
+  ];
 
   pythonImportsCheck = [ "forecast_solar" ];
 
diff --git a/pkgs/development/python-modules/pluthon/default.nix b/pkgs/development/python-modules/pluthon/default.nix
index 3467d9b21314..21994bd0817e 100644
--- a/pkgs/development/python-modules/pluthon/default.nix
+++ b/pkgs/development/python-modules/pluthon/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   buildPythonPackage,
   setuptools,
   pythonOlder,
@@ -13,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pluthon";
-  version = "0.5.3";
+  version = "1.0.0";
 
   format = "pyproject";
 
@@ -21,18 +20,9 @@ buildPythonPackage rec {
     owner = "OpShin";
     repo = "pluthon";
     rev = version;
-    hash = "sha256-pX/XPZJQZaSY06nLLEvhf+1LEqYG3CdgPV/3Q6XOzTs=";
+    hash = "sha256-IYpkb/RXRu53HoeVKik7Jog5FyXwrWItrxSla9dN0s4=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "pluthon-bump-uplc.patch";
-      # https://github.com/OpShin/pluthon/pull/21
-      url = "https://github.com/OpShin/pluthon/commit/4b0a40223f253643056cab12231264c5beffc666.patch?full_index=1";
-      hash = "sha256-dO9JaIpkugZFKsr3Hd0cFCy7K+cmf77UfrdkZ+sGQtA=";
-    })
-  ];
-
   propagatedBuildInputs = [
     setuptools
     uplc
diff --git a/pkgs/development/python-modules/rply/default.nix b/pkgs/development/python-modules/rply/default.nix
index 037bbca05e52..064a7a7a9040 100644
--- a/pkgs/development/python-modules/rply/default.nix
+++ b/pkgs/development/python-modules/rply/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "rply";
-  version = "0.7.7";
+  version = "0.7.8";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "alex";
     repo = "rply";
     rev = "v${version}";
-    hash = "sha256-5uINDCX4Jr4bSSwqBjvkS3f5wTMnZvsRGq1DeCw8Y+M=";
+    hash = "sha256-mO/wcIsDIBjoxUsFvzftj5H5ziJijJcoyrUk52fcyE4=";
   };
 
   propagatedBuildInputs = [ appdirs ];
diff --git a/pkgs/development/python-modules/uplc/default.nix b/pkgs/development/python-modules/uplc/default.nix
index bc2111a78ca5..0de44fb056ca 100644
--- a/pkgs/development/python-modules/uplc/default.nix
+++ b/pkgs/development/python-modules/uplc/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "uplc";
-  version = "1.0.4";
+  version = "1.0.6";
 
   format = "pyproject";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "OpShin";
     repo = "uplc";
     rev = version;
-    hash = "sha256-Mio6VVgQKy1GMeHNk0DITks9Nhr3lA1t7zewu9734j4=";
+    hash = "sha256-FQH2GE6ihLcHtEavAYFPr8xsRqnUROtZ8yyIfRbY9CQ=";
   };
 
   propagatedBuildInputs = [
@@ -37,16 +37,11 @@ buildPythonPackage rec {
     python-secp256k1-cardano
   ];
 
-  pythonRelaxDeps = [
-    "pycardano"
-    "rply"
-  ];
-
   pythonImportsCheck = [ "uplc" ];
 
   meta = with lib; {
     description = "Python implementation of untyped plutus language core";
-    homepage = "https://opshin.dev";
+    homepage = "https://github.com/OpShin/uplc";
     license = licenses.mit;
     maintainers = with maintainers; [ t4ccer ];
     mainProgram = "opshin";
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index be6c65faec9b..8c54682ca676 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.34.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     rev = "v${version}";
-    hash = "sha256-a2OuxstfZcN49CLn4Tk6DeCXUKZOrMQ7pNDicmNxVRA=";
+    hash = "sha256-Y3rcp/bSbPHCocq1gy9ytzwF10+vOUMX4hBAw4dJpHI=";
   };
 
-  vendorHash = "sha256-rAuFXXoC0zp/n+2Ogxrj7Ji3wpQ45XloOs7nI8K41eo=";
+  vendorHash = "sha256-TrAisrKBM8beccya0o8WO4AatKsPiXzeR46213ZBi38=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
diff --git a/pkgs/development/tools/fastddsgen/default.nix b/pkgs/development/tools/fastddsgen/default.nix
index 1a38ca3050ce..8d1110334f45 100644
--- a/pkgs/development/tools/fastddsgen/default.nix
+++ b/pkgs/development/tools/fastddsgen/default.nix
@@ -1,4 +1,11 @@
-{ lib, stdenv, runtimeShell, fetchFromGitHub, gradle_7, openjdk17 }:
+{ lib
+, stdenv
+, makeWrapper
+, fetchFromGitHub
+, gradle_7
+, openjdk17
+}:
+
 let
   pname = "fastddsgen";
   version = "3.3.0";
@@ -17,7 +24,11 @@ stdenv.mkDerivation {
     hash = "sha256-oqbSIzsYUwD8bTqGKZ9he9d18EDq9mHZFoNUp0RK0qU=";
   };
 
-  nativeBuildInputs = [ gradle openjdk17 ];
+  nativeBuildInputs = [
+    gradle
+    openjdk17
+    makeWrapper
+  ];
 
   mitmCache = gradle.fetchDeps {
     inherit pname;
@@ -33,12 +44,12 @@ stdenv.mkDerivation {
 
     gradle install --install_path=$out
 
-    # Override the default start script to use absolute java path
-    cat  <<EOF >$out/bin/fastddsgen
-    #!${runtimeShell}
-    exec ${openjdk17}/bin/java -jar "$out/share/fastddsgen/java/fastddsgen.jar" "\$@"
-    EOF
-    chmod a+x "$out/bin/fastddsgen"
+    # Override the default start script to use absolute java path.
+    # Make the unwrapped "cpp" available in the path, since the wrapped "cpp"
+    # passes additional flags and produces output incompatible with fastddsgen.
+    makeWrapper ${openjdk17}/bin/java $out/bin/fastddsgen \
+      --add-flags "-jar $out/share/fastddsgen/java/fastddsgen.jar" \
+      --prefix PATH : ${lib.makeBinPath [ stdenv.cc.cc ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/development/tools/misc/cproto/default.nix b/pkgs/development/tools/misc/cproto/default.nix
index 976f34f35fb5..faf0e8e5a4ee 100644
--- a/pkgs/development/tools/misc/cproto/default.nix
+++ b/pkgs/development/tools/misc/cproto/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "cproto";
-  version = "4.7v";
+  version = "4.7w";
 
   src = fetchurl {
     urls = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       # No version listings and apparently no versioned tarball over http(s).
       "ftp://ftp.invisible-island.net/cproto/cproto-${version}.tgz"
     ];
-    sha256 = "sha256-897D9hAncBlpdkWcS0SsJzVfYSDaduUjHsEyPjedFRE=";
+    sha256 = "sha256-ix1GjM2aKFnzmcdf773KDf3KTcMYkf7bxArFwybSe20=";
   };
 
   # patch made by Joe Khoobyar copied from gentoo bugs
diff --git a/pkgs/development/tools/spring-boot-cli/default.nix b/pkgs/development/tools/spring-boot-cli/default.nix
index 572ed0cfe1f8..d7d0acdd813c 100644
--- a/pkgs/development/tools/spring-boot-cli/default.nix
+++ b/pkgs/development/tools/spring-boot-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spring-boot-cli";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchzip {
     url = "mirror://maven/org/springframework/boot/spring-boot-cli/${finalAttrs.version}/spring-boot-cli-${finalAttrs.version}-bin.zip";
-    hash = "sha256-3Mlid+hvHVjAw5pE6vyieSHWH8Zkoty3GuwE1gB5yQM=";
+    hash = "sha256-6xHiSd+CEFOZHiSLfAeMp/xcnTuEkFpCzYLgnnNkRN4=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/wabt/default.nix b/pkgs/development/tools/wabt/default.nix
index d4454dd5459b..f2be63608b69 100644
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wabt";
-  version = "1.0.35";
+  version = "1.0.36";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wabt";
     rev = version;
-    hash = "sha256-oWyHR2HRDA/N5Rm9EXhOi+lZ2N7In6HmE74ZL2Nyu9A=";
+    hash = "sha256-CswVvL6yxTf0ju/UPvEGMgTuNZ8mumSIcnVbYVfy178=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index 79493f310dab..d2184a208c00 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -38,12 +38,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
-  version = "3.13.3";
+  version = "3.13.6";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-CPnoPK3tBKKmIo8IioUCUWkw6+sdvzRaAngseRZ8eUM=";
+    hash = "sha256-y6rHZpAhXVuO6sn18ZRvbG8qajTCVdE7iWkn+KXUhwI=";
   };
 
   nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync python3 ];
diff --git a/pkgs/servers/prowlarr/default.nix b/pkgs/servers/prowlarr/default.nix
index 3573faf1b4f2..9e53fa925ab8 100644
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@@ -21,15 +21,15 @@ let
   }.${stdenv.hostPlatform.system} or unsupported;
 
   hash = {
-    aarch64-darwin = "sha256-LmRF4hXVbjYj/4v4SKwBm5lRFUuHv11h3tmWo2vOskQ=";
-    aarch64-linux = "sha256-fj0E1lcCLJs4jQwQQBmbh6uts0axubhxDz7kn1Qzuk4=";
-    x86_64-darwin = "sha256-1P+R9MBaWsLYVST+WlyI7TH+1ZmB90J9P2IP2WVZEvE=";
-    x86_64-linux = "sha256-V0MNjLswcxtyU7kl7Gn5474SGSAfwUVHbJcsYVE4WfY=";
+    aarch64-darwin = "sha256-oYcvfqOHhN4xZc7XbnP+5oTUVRkA8Bww/Afmrr/bCLY=";
+    aarch64-linux = "sha256-/pATypGVLSCVdAEXOOHMfemL/k3aMxSlY5KGGQlD5oc=";
+    x86_64-darwin = "sha256-7PymLnqhCiF2v6bkAGNJWnXmdRUxRXTXgag848pdKIk=";
+    x86_64-linux = "sha256-mEUfnYdnX2JE9mz15ESUtxYxRlmjCApdI0DuVWzHWLc=";
   }.${stdenv.hostPlatform.system} or unsupported;
 
 in stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.20.1.4603";
+  version = "1.21.2.4649";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index a9bff8533ab9..adcd4df02c3d 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "groonga";
-  version = "14.0.5";
+  version = "14.0.6";
 
   src = fetchurl {
     url = "https://packages.groonga.org/source/groonga/groonga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-y4UGnv8kK0z+br8wXpPf57NMXkdEJHcLCuTvYiubnIc=";
+    hash = "sha256-1caTQAycvpG2PgtbxIn58HrxvWjxKgiczRSC72nWzGw=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/instaloader/default.nix b/pkgs/tools/misc/instaloader/default.nix
index 4b36d0909bf4..c5565090c960 100644
--- a/pkgs/tools/misc/instaloader/default.nix
+++ b/pkgs/tools/misc/instaloader/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "instaloader";
-  version = "4.11";
+  version = "4.13";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "instaloader";
     repo = "instaloader";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-EqE184tYW815Hp42EB5g0l9f5AWpYSqH+cY4z4zsCSQ=";
+    sha256 = "sha256-nZNoxJnp8dBbgXWYLfzasTa9SsR03xA1mpl9NKppodE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/gvproxy/default.nix b/pkgs/tools/networking/gvproxy/default.nix
index 78c45563540f..621c931c3e24 100644
--- a/pkgs/tools/networking/gvproxy/default.nix
+++ b/pkgs/tools/networking/gvproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gvproxy";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "gvisor-tap-vsock";
     rev = "v${version}";
-    hash = "sha256-7j/0VuiHjazsPnyQ4NbmvXX1O/NbeB9l6HfmTRZyAW8=";
+    hash = "sha256-ovNYPYLC01xt7uiaXkFsLHiywAhQVa0tELk/AA8dxqs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/networking/swagger-codegen3/default.nix b/pkgs/tools/networking/swagger-codegen3/default.nix
index 257a6a9a27bb..c23cd944a6e2 100644
--- a/pkgs/tools/networking/swagger-codegen3/default.nix
+++ b/pkgs/tools/networking/swagger-codegen3/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, jre, makeWrapper, testers, swagger-codegen3 }:
 
 stdenv.mkDerivation rec {
-  version = "3.0.58";
+  version = "3.0.59";
   pname = "swagger-codegen";
 
   jarfilename = "${pname}-cli-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/io/swagger/codegen/v3/${pname}-cli/${version}/${jarfilename}";
-    sha256 = "sha256-+6jWSNDxX6ZqdOYCQ+Vqpfv95drZLqp1AGW4YdNY57M=";
+    sha256 = "sha256-Imlu/dyfCJ7S1cxkkLcifj+0mdU/QUYdKnemFTZHGig=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index aeefcaa0bbef..5f27e61ec39f 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -17,6 +17,8 @@
   withOpenCL ? true,
   opencl-headers,
   ocl-icd,
+  # include non-free ClamAV unrar code
+  enableUnfree ? false,
   substituteAll,
   makeWrapper,
 }:
@@ -64,7 +66,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--disable-native-tests"
     "--with-systemwide"
-  ];
+  ] ++ lib.optionals (!enableUnfree) [ "--without-unrar" ];
 
   buildInputs =
     [
@@ -131,7 +133,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "John the Ripper password cracker";
-    license = licenses.gpl2Plus;
+    license = [ licenses.gpl2Plus ] ++ lib.optionals enableUnfree [ licenses.unfreeRedistributable ];
     homepage = "https://github.com/openwall/john/";
     maintainers = with maintainers; [
       offline
diff --git a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
index 838a51324a09..1848bf26b5b5 100644
--- a/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/tectonic.nix
@@ -10,7 +10,7 @@ tectonic-unwrapped.override (old: {
         hash = "sha256-ap7fEPHsASAphIQkjcvk1CC7egTdxaUh7IpSS5os4W8=";
         fetchSubmodules = true;
       };
-      cargoHash = "sha256-62sxvPIiY3len1wsl7QelK3u4ekftIjcTqoIGZMYb5A=";
+      cargoHash = "sha256-g4iBo8r+QUOcFJ3CI2+HOi4VHxU7jKnIWlJcKx/6r5E=";
       # binary has a different name, bundled tests won't work
       doCheck = false;
       meta.mainProgram = "texpresso-tonic";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5cd32e0cb4d0..8b15f42c3fa9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -883,7 +883,7 @@ mapAliases ({
   linuxPackages_testing_bcachefs = throw "'linuxPackages_testing_bcachefs' has been removed, please use 'linuxPackages_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
   linux_testing_bcachefs = throw "'linux_testing_bcachefs' has been removed, please use 'linux_latest', any kernel version at least 6.7, or any other linux kernel with bcachefs support";
 
-  llvmPackages_git = (recurseIntoAttrs (callPackages ../development/compilers/llvm { })).git;
+  llvmPackages_git = (callPackages ../development/compilers/llvm { }).git;
 
   lld_6 = throw "lld_6 has been removed from nixpkgs"; # Added 2024-01-08
   lld_7 = throw "lld_7 has been removed from nixpkgs"; # Added 2023-11-19
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7496252da2ea..a0d28150f966 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20467,12 +20467,21 @@ with pkgs;
   # Only supported on Linux and only on glibc
   glibcLocales =
     if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu
-    then callPackage ../development/libraries/glibc/locales.nix { }
-    else null;
+    then callPackage ../development/libraries/glibc/locales.nix {
+      stdenv = if (!stdenv.cc.isGNU) then
+        gccStdenv
+      else stdenv;
+      withLinuxHeaders = !stdenv.cc.isGNU;
+    } else null;
   glibcLocalesUtf8 =
     if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu
-    then callPackage ../development/libraries/glibc/locales.nix { allLocales = false; }
-    else null;
+    then callPackage ../development/libraries/glibc/locales.nix {
+      stdenv = if (!stdenv.cc.isGNU) then
+        gccStdenv
+      else stdenv;
+      withLinuxHeaders = !stdenv.cc.isGNU;
+      allLocales = false;
+    } else null;
 
   glibcInfo = callPackage ../development/libraries/glibc/info.nix { };
 
@@ -26868,7 +26877,6 @@ with pkgs;
 
   ocf-resource-agents = callPackage ../os-specific/linux/ocf-resource-agents { };
 
-  open-vm-tools = callPackage ../applications/virtualization/open-vm-tools { };
   open-vm-tools-headless = open-vm-tools.override { withX = false; };
 
   oxtools = callPackage ../os-specific/linux/oxtools { };