diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 930d1cd6d33f..28c34b4d11f2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10805,6 +10805,16 @@
       fingerprint = "8CE3 2906 516F C4D8 D373  308A E189 648A 55F5 9A9F";
     }];
   };
+  mib = {
+    name = "mib";
+    email = "mib@kanp.ai";
+    matrix = "@mib:kanp.ai";
+    github = "mibmo";
+    githubId = 87388017;
+    keys = [{
+      fingerprint = "AB0D C647 B2F7 86EB 045C 7EFE CF6E 67DE D6DC 1E3F";
+    }];
+  };
   mic92 = {
     email = "joerg@thalheim.io";
     matrix = "@mic92:nixos.dev";
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 56da95dca94d..346b50700c79 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -29,11 +29,11 @@ let
     folder.enable
   ) cfg.settings.folders);
 
-  updateConfig = pkgs.writers.writeDash "merge-syncthing-config" ''
+  jq = "${pkgs.jq}/bin/jq";
+  updateConfig = pkgs.writers.writeBash "merge-syncthing-config" (''
     set -efu
 
     # be careful not to leak secrets in the filesystem or in process listings
-
     umask 0077
 
     # get the api key by parsing the config.xml
@@ -51,25 +51,85 @@ let
             --retry 1000 --retry-delay 1 --retry-all-errors \
             "$@"
     }
+  '' +
 
-    # query the old config
-    old_cfg=$(curl ${cfg.guiAddress}/rest/config)
-
-    # generate the new config by merging with the NixOS config options
-    new_cfg=$(printf '%s\n' "$old_cfg" | ${pkgs.jq}/bin/jq -c ${escapeShellArg ''. * ${builtins.toJSON cleanedConfig} * {
-        "devices": ('${escapeShellArg (builtins.toJSON devices)}'${optionalString (cfg.settings.devices == {} || ! cfg.overrideDevices) " + .devices"}),
-        "folders": ('${escapeShellArg (builtins.toJSON folders)}'${optionalString (cfg.settings.folders == {} || ! cfg.overrideFolders) " + .folders"})
-    }''})
-
-    # send the new config
-    curl -X PUT -d "$new_cfg" ${cfg.guiAddress}/rest/config
-
+  /* Syncthing's rest API for the folders and devices is almost identical.
+  Hence we iterate them using lib.pipe and generate shell commands for both at
+  the sime time. */
+  (lib.pipe {
+    # The attributes below are the only ones that are different for devices /
+    # folders.
+    devs = {
+      new_conf_IDs = map (v: v.id) devices;
+      GET_IdAttrName = "deviceID";
+      override = cfg.overrideDevices;
+      conf = devices;
+      baseAddress = "${cfg.guiAddress}/rest/config/devices";
+    };
+    dirs = {
+      new_conf_IDs = map (v: v.id) folders;
+      GET_IdAttrName = "id";
+      override = cfg.overrideFolders;
+      conf = folders;
+      baseAddress = "${cfg.guiAddress}/rest/config/folders";
+    };
+  } [
+    # Now for each of these attributes, write the curl commands that are
+    # identical to both folders and devices.
+    (mapAttrs (conf_type: s:
+      # We iterate the `conf` list now, and run a curl -X POST command for each, that
+      # should update that device/folder only.
+      lib.pipe s.conf [
+        # Quoting https://docs.syncthing.net/rest/config.html:
+        #
+        # > PUT takes an array and POST a single object. In both cases if a
+        # given folder/device already exists, it’s replaced, otherwise a new
+        # one is added.
+        #
+        # What's not documented, is that using PUT will remove objects that
+        # don't exist in the array given. That's why we use here `POST`, and
+        # only if s.override == true then we DELETE the relevant folders
+        # afterwards.
+        (map (new_cfg: ''
+          curl -d ${lib.escapeShellArg (builtins.toJSON new_cfg)} -X POST ${s.baseAddress}
+        ''))
+        (lib.concatStringsSep "\n")
+      ]
+      /* If we need to override devices/folders, we iterate all currently configured
+      IDs, via another `curl -X GET`, and we delete all IDs that are not part of
+      the Nix configured list of IDs
+      */
+      + lib.optionalString s.override ''
+        old_conf_${conf_type}_ids="$(curl -X GET ${s.baseAddress} | ${jq} --raw-output '.[].${s.GET_IdAttrName}')"
+        for id in ''${old_conf_${conf_type}_ids}; do
+          if echo ${lib.concatStringsSep " " s.new_conf_IDs} | grep -q $id; then
+            continue
+          else
+            curl -X DELETE ${s.baseAddress}/$id
+          fi
+        done
+      ''
+    ))
+    builtins.attrValues
+    (lib.concatStringsSep "\n")
+  ]) +
+  /* Now we update the other settings defined in cleanedConfig which are not
+  "folders" or "devices". */
+  (lib.pipe cleanedConfig [
+    builtins.attrNames
+    (lib.subtractLists ["folders" "devices"])
+    (map (subOption: ''
+      curl -X PUT -d ${lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})} \
+        ${cfg.guiAddress}/rest/config/${subOption}
+    ''))
+    (lib.concatStringsSep "\n")
+  ]) + ''
     # restart Syncthing if required
     if curl ${cfg.guiAddress}/rest/config/restart-required |
-       ${pkgs.jq}/bin/jq -e .requiresRestart > /dev/null; then
+       ${jq} -e .requiresRestart > /dev/null; then
         curl -X POST ${cfg.guiAddress}/rest/system/restart
     fi
-  '';
+  '');
 in {
   ###### interface
   options = {
diff --git a/pkgs/development/compilers/otus-lisp/default.nix b/pkgs/development/compilers/otus-lisp/default.nix
new file mode 100644
index 000000000000..5338734e6c6d
--- /dev/null
+++ b/pkgs/development/compilers/otus-lisp/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, xxd }:
+
+stdenv.mkDerivation rec {
+  pname = "otus-lisp";
+  version = "2.4";
+
+  src = fetchFromGitHub {
+    owner = "yuriy-chumak";
+    repo = "ol";
+    rev = version;
+    sha256 = "sha256-+6qH1BhvMkuG2rUOfo9qMjMjhCib9KONQTBWS27c3Ts=";
+  };
+
+  nativeBuildInputs = [ xxd ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "A purely functional dialect of Lisp";
+    homepage = "https://yuriy-chumak.github.io/ol/";
+    license = with lib.licenses; [ mit lgpl3Only ]; # dual licensed
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ nagy ];
+  };
+}
diff --git a/pkgs/development/libraries/ctranslate2/default.nix b/pkgs/development/libraries/ctranslate2/default.nix
index 5dbd959b5e96..e512321c5051 100644
--- a/pkgs/development/libraries/ctranslate2/default.nix
+++ b/pkgs/development/libraries/ctranslate2/default.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ctranslate2";
-  version = "3.16.1";
+  version = "3.17.1";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     rev = "v${version}";
-    hash = "sha256-6K4TQnm9va+oxwWuKfV+txF7rRBRzE6PoUEDA2v3lEM=";
+    hash = "sha256-aSYE8+vhCsgZf1gBqJFRK8cn91AxrRutJc3LzHQQHVc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index 35811b8129a6..3fc45705b27e 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -71,7 +71,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.40.3";
+  version = "2.40.4";
   name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";
 
   outputs = [ "out" "dev" "devdoc" ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zAqoP0DbxkwcauQuxrha9L4qnb9STPy5X4mjZ/tQmN0=";
+    hash = "sha256-jRYzeSl6L39RtFUSf5mDbZ/hVyKJ93tjD/PWOiywbaw=";
   };
 
   patches = lib.optionals stdenv.isLinux [
diff --git a/pkgs/development/python-modules/faster-whisper/default.nix b/pkgs/development/python-modules/faster-whisper/default.nix
index 86529151e91c..4dc36fd5fc24 100644
--- a/pkgs/development/python-modules/faster-whisper/default.nix
+++ b/pkgs/development/python-modules/faster-whisper/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "faster-whisper";
-  version = "0.6.0";
+  version = "0.7.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "guillaumekln";
     repo = "faster-whisper";
     rev = "v${version}";
-    hash = "sha256-tBajxrAhV7R9VnAzUr7ONAYH9h8Uh/UUeu2YZAAotBo=";
+    hash = "sha256-p8BJ+Bdvn+AQSUS6b2GeYNh2l4KXfPx3o0kImu7xVgw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/ninja/default.nix b/pkgs/development/python-modules/ninja/default.nix
new file mode 100644
index 000000000000..d3ab12c29a55
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchurl
+, cmake
+, setuptools-scm
+, scikit-build
+, pytestCheckHook
+, pytest-virtualenv
+}:
+let
+  # these must match NinjaUrls.cmake
+  ninja_src_url = "https://github.com/Kitware/ninja/archive/v1.11.1.g95dee.kitware.jobserver-1.tar.gz";
+  ninja_src_sha256 = "7ba84551f5b315b4270dc7c51adef5dff83a2154a3665a6c9744245c122dd0db";
+  ninja_src = fetchurl {
+    url = ninja_src_url;
+    sha256 = ninja_src_sha256;
+  };
+in
+buildPythonPackage rec {
+  pname = "ninja";
+  version = "1.11.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "scikit-build";
+    repo = "ninja-python-distributions";
+    rev = version;
+    hash = "sha256-scCYsSEyN+u3qZhNhWYqHpJCl+JVJJbKz+T34gOXGJM=";
+  };
+  patches = [
+    # make sure cmake doesn't try to download the ninja sources
+    ./no-download.patch
+  ];
+
+  inherit ninja_src;
+  postUnpack = ''
+    # assume that if the hash matches, the source should be fine
+    if ! grep "${ninja_src_sha256}" $sourceRoot/NinjaUrls.cmake; then
+      echo "ninja_src_sha256 doesn't match the hash in NinjaUrls.cmake!"
+      exit 1
+    fi
+    mkdir -p "$sourceRoot/Ninja-src"
+    pushd "$sourceRoot/Ninja-src"
+    tar -xavf ${ninja_src} --strip-components 1
+    popd
+  '';
+
+  postPatch = ''
+    sed -i '/cov/d' setup.cfg
+  '';
+
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    setuptools-scm
+    scikit-build
+    cmake
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-virtualenv
+  ];
+
+  meta = with lib; {
+    description = "A small build system with a focus on speed";
+    homepage = "https://github.com/scikit-build/ninja-python-distributions";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ _999eagle ];
+  };
+}
diff --git a/pkgs/development/python-modules/ninja/no-download.patch b/pkgs/development/python-modules/ninja/no-download.patch
new file mode 100644
index 000000000000..0937a5fde1ea
--- /dev/null
+++ b/pkgs/development/python-modules/ninja/no-download.patch
@@ -0,0 +1,10 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -64,6 +64,7 @@
+   # Download selected source archive
+   ExternalProject_add(download_ninja_source
+     SOURCE_DIR ${Ninja_SOURCE_DIR}
++    DOWNLOAD_COMMAND ""
+     URL ${${src_archive}_url}
+     URL_HASH SHA256=${${src_archive}_sha256}
+     DOWNLOAD_DIR ${ARCHIVE_DOWNLOAD_DIR}
diff --git a/pkgs/development/python-modules/picosvg/default.nix b/pkgs/development/python-modules/picosvg/default.nix
new file mode 100644
index 000000000000..a04479cfb414
--- /dev/null
+++ b/pkgs/development/python-modules/picosvg/default.nix
@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, setuptools-scm
+, absl-py
+, lxml
+, skia-pathops
+, pytestCheckHook
+}:
+buildPythonPackage rec {
+  pname = "picosvg";
+  version = "0.22.0";
+
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-J06ijF1c3ZKPqKiQha6yqfj8EjFZoZzA6i6UCCrexi8=";
+  };
+
+  patches = [
+    # see https://github.com/googlefonts/picosvg/issues/299
+    # this patch fixed a failing test case after the update to skia-pathops 0.8
+    # as soon as skia-pathops in nixpkgs is updated to 0.8, this patch should be removed
+    (fetchpatch {
+      url = "https://github.com/googlefonts/picosvg/commit/4e971ed6cd9afb412b2845d29296a0c24f086562.patch";
+      hash = "sha256-OZEipNPCSuuqcy4XggBiuGv4HN604dI4N9wlznyAwF0=";
+      revert = true;
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    absl-py
+    lxml
+    skia-pathops
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  # a few tests are failing on aarch64
+  doCheck = !stdenv.isAarch64;
+
+  meta = with lib; {
+    description = "Tool to simplify SVGs";
+    homepage = "https://github.com/googlefonts/picosvg";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ _999eagle ];
+  };
+}
diff --git a/pkgs/development/python-modules/ucsmsdk/default.nix b/pkgs/development/python-modules/ucsmsdk/default.nix
new file mode 100644
index 000000000000..f9d1cf6c1d79
--- /dev/null
+++ b/pkgs/development/python-modules/ucsmsdk/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pyparsing
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "ucsmsdk";
+  version = "0.9.14";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "CiscoUcs";
+    repo = "ucsmsdk";
+    rev = "v${version}";
+    hash = "sha256-lSkURvKRgW+qV1A8OT4WYsMGlxxIqaFnxQ3Rnlixdw0=";
+  };
+
+  propagatedBuildInputs = [
+    pyparsing
+    six
+  ];
+
+  # most tests are broken
+  doCheck = false;
+
+  pythonImportsCheck = [ "ucsmsdk" ];
+
+  meta = with lib; {
+    description = "Python SDK for Cisco UCS";
+    homepage = "https://github.com/CiscoUcs/ucsmsdk";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 6e1b166ecca0..a39c8e9f5014 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -36,29 +36,20 @@
 assert lib.asserts.assertOneOf "withPrecision" withPrecision [ "single" "double" ];
 
 let
-  options = {
-    # Options from 'godot/SConstruct'
-    platform = withPlatform;
-    target = withTarget;
-    precision = withPrecision; # Floating-point precision level
-
-    # Options from 'godot/platform/linuxbsd/detect.py'
-    pulseaudio = withPulseaudio; # Use PulseAudio
-    dbus = withDbus; # Use D-Bus to handle screensaver and portal desktop settings
-    speechd = withSpeechd; # Use Speech Dispatcher for Text-to-Speech support
-    fontconfig = withFontconfig; # Use fontconfig for system fonts support
-    udev = withUdev; # Use udev for gamepad connection callbacks
-    touch = withTouch; # Enable touch events
-  };
+  mkSconsFlagsFromAttrSet = lib.mapAttrsToList (k: v:
+    if builtins.isString v
+    then "${k}=${v}"
+    else "${k}=${builtins.toJSON v}");
 in
 stdenv.mkDerivation rec {
   pname = "godot";
   version = "4.1-stable";
+  commitHash = "970459615f6b2b4151742ec6d7ef8559f87fd5c5";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
-    rev = version;
+    rev = commitHash;
     hash = "sha256-v9qKrPYQz4c+xkSu/2ru7ZE5EzKVyXhmrxyHZQkng2U=";
   };
 
@@ -96,15 +87,44 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # Options from 'godot/SConstruct' and 'godot/platform/linuxbsd/detect.py'
-  sconsFlags = [ "production=true" ];
+  # Set the build name which is part of the version. In official downloads, this
+  # is set to 'official'. When not specified explicitly, it is set to
+  # 'custom_build'. Other platforms packaging Godot (Gentoo, Arch, Flatpack
+  # etc.) usually set this to their name as well.
+  #
+  # See also 'methods.py' in the Godot repo and 'build' in
+  # https://docs.godotengine.org/en/stable/classes/class_engine.html#class-engine-method-get-version-info
+  BUILD_NAME = "nixpkgs";
+
+  # Required for the commit hash to be included in the version number.
+  #
+  # `methods.py` reads the commit hash from `.git/HEAD` and manually follows
+  # refs. Since we just write the hash directly, there is no need to emulate any
+  # other parts of the .git directory.
+  #
+  # See also 'hash' in
+  # https://docs.godotengine.org/en/stable/classes/class_engine.html#class-engine-method-get-version-info
   preConfigure = ''
-    sconsFlags+=" ${
-      lib.concatStringsSep " "
-      (lib.mapAttrsToList (k: v: "${k}=${builtins.toJSON v}") options)
-    }"
+    mkdir -p .git
+    echo ${commitHash} > .git/HEAD
   '';
 
+  sconsFlags = mkSconsFlagsFromAttrSet {
+    # Options from 'SConstruct'
+    production = true; # Set defaults to build Godot for use in production
+    platform = withPlatform;
+    target = withTarget;
+    precision = withPrecision; # Floating-point precision level
+
+    # Options from 'platform/linuxbsd/detect.py'
+    pulseaudio = withPulseaudio; # Use PulseAudio
+    dbus = withDbus; # Use D-Bus to handle screensaver and portal desktop settings
+    speechd = withSpeechd; # Use Speech Dispatcher for Text-to-Speech support
+    fontconfig = withFontconfig; # Use fontconfig for system fonts support
+    udev = withUdev; # Use udev for gamepad connection callbacks
+    touch = withTouch; # Enable touch events
+  };
+
   outputs = [ "out" "man" ];
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 2d0caf161316..3bf19de28338 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.120";
+  version = "5.15.121";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1xl3nrykbxdwv5a9rk0xnb7l61dsyjvkm1ryrdii09vbmsg0i6b4";
+    sha256 = "07f3a68r1yb4p19z1azjwp2vhjb3ayh31hz9hfb4a98dn2ywxq07";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index b52a2798fcc2..c8ecfc95f355 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.39";
+  version = "6.1.40";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac";
+    sha256 = "1w474pia4pxz4qbfai27ary1y1h2fnn7kvx7yz7wszd0jwhzrsj3";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index 189f4da7ecae..b87269589ae3 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.4";
+  version = "6.4.5";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w";
+    sha256 = "1dz9inr1bf7jx5s9n0dfa0srfzrwnz1zmdq42bbxyl9w8q3jqkip";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index 484aebd644b4..c28aafad3877 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,13 +16,13 @@
 
 buildGoModule rec {
   pname = "evcc";
-  version = "0.118.9";
+  version = "0.118.10";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = pname;
     rev = version;
-    hash = "sha256-y92kxFCKsLZmLVvgTjYsIVo8qVA/QRMGSChMtY8Go2g=";
+    hash = "sha256-A79l8tA73EeRp+BlJnIz/qtiBk33D4KvbJegqrgNvbg=";
   };
 
   vendorHash = "sha256-0NTOit1nhX/zxQjHwU7ZOY1GsoIu959/KICCEWyfIQ4=";
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 3af5e5b6f551..740e72179e22 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
 let
-  version = "1.44.0";
+  version = "1.46.0";
 in
 buildGoModule {
   pname = "tailscale";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-/SiQFkhVseLkjK7ePNzNyBs0r3XE3kHJ6CDTFjdCXec=";
+    hash = "sha256-JA4mTxVlDpD1U360mvLYQv2inZg6VnljAYtVc21Qmfc=";
   };
-  vendorHash = "sha256-fgCrmtJs1svFz0Xn7iwLNrbBNlcO6V0yqGPMY0+V1VQ=";
+  vendorHash = "sha256-yORh/jxBApu+XeAWczw7BLijNdF9DdoK8CfICBuCitU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/tools/admin/balena-cli/default.nix b/pkgs/tools/admin/balena-cli/default.nix
index f892edc5f54c..8246707fec0c 100644
--- a/pkgs/tools/admin/balena-cli/default.nix
+++ b/pkgs/tools/admin/balena-cli/default.nix
@@ -15,12 +15,12 @@ let
   }.${system} or throwSystem;
 
   sha256 = {
-    x86_64-linux = "sha256-yNyQ3cmy0Rc2+8EygMJwB/kmmmOiyq5V+7dyFFHyaVA=";
-    x86_64-darwin = "sha256-sODceZObYQned+opKQ4BgRZxlJQ12c2D01+FG8JF2N0=";
-    aarch64-darwin = "sha256-sODceZObYQned+opKQ4BgRZxlJQ12c2D01+FG8JF2N0=";
+    x86_64-linux = "sha256-/Die6tpidmt3dTzW7mEnQJG5vlxue4sT44PcAa7lrgk=";
+    x86_64-darwin = "sha256-VB5075VfQRtlLoG3lfkVz8ASoODiwleTYC2JJR51LtI=";
+    aarch64-darwin = "sha256-VB5075VfQRtlLoG3lfkVz8ASoODiwleTYC2JJR51LtI=";
   }.${system} or throwSystem;
 
-  version = "16.6.2";
+  version = "16.7.5";
   src = fetchzip {
     url = "https://github.com/balena-io/balena-cli/releases/download/v${version}/balena-cli-v${version}-${plat}-standalone.zip";
     inherit sha256;
diff --git a/pkgs/tools/games/slipstream/default.nix b/pkgs/tools/games/slipstream/default.nix
new file mode 100644
index 000000000000..6a41cd6b52db
--- /dev/null
+++ b/pkgs/tools/games/slipstream/default.nix
@@ -0,0 +1,49 @@
+{ lib, fetchFromGitHub, stdenv, makeWrapper, buildMaven, maven, jdk }:
+let
+  mavenWithJdk = maven.override { inherit jdk; };
+in
+mavenWithJdk.buildMavenPackage rec {
+  pname = "slipstream";
+  version = "1.9.1";
+
+  src = fetchFromGitHub {
+    owner = "Vhati";
+    repo = "Slipstream-Mod-Manager";
+    rev = "v${version}";
+    hash = "sha256-F+o94Oh9qxVdfgwdmyOv+WZl1BjQuzhQWaVrAgScgIU=";
+  };
+
+  mvnHash = "sha256-oDtUitsfZPiDtyfzzw1yMNBCKyP6rHczKZT/SPPJYGE=";
+
+  nativeBuildInputs = [ mavenWithJdk makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/java
+    install -Dm644 target/ftl-mod-manager-${version}.jar $out/share/java
+    install -Dm644 target/modman.jar $out/share/java
+
+    # slipstream is very finniky about having specific
+    # folders at startup, so wrapper creates them for it.
+    # this is because slipstream expects to be started from
+    # archive it comes from, but we can't do that since
+    # we need the mods directory to be writable.
+    # see: https://github.com/Vhati/Slipstream-Mod-Manager/blob/85cad4ffbef8583d908b189204d7d22a26be43f8/src/main/java/net/vhati/modmanager/cli/SlipstreamCLI.java#L105
+    makeWrapper ${jdk}/bin/java $out/bin/${pname} \
+      --run '_dir="''${XDG_DATA_HOME:-$HOME/.local/share}/slipstream"' \
+      --run 'mkdir -p $_dir/{mods,backup}' \
+      --run 'cd $_dir' \
+      --append-flags "-jar $out/share/java/modman.jar"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A mod manager for FTL: Faster Than Light";
+    homepage = "https://github.com/Vhati/Slipstream-Mod-Manager";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ mib ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/nanoemoji/default.nix b/pkgs/tools/misc/nanoemoji/default.nix
new file mode 100644
index 000000000000..93817ff84798
--- /dev/null
+++ b/pkgs/tools/misc/nanoemoji/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, python3
+, fetchFromGitHub
+, resvg
+, pngquant
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "nanoemoji";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-P/lT0PnjTdYzyttICzszu4OL5kj+X8GHZ8doL3tpXQM=";
+  };
+  patches = [
+    # this is necessary because the tests clear PATH/PYTHONPATH otherwise
+    ./test-pythonpath.patch
+    # minor difference in the test output, most likely due to different dependency versions
+    ./fix-test.patch
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools-scm
+    pythonRelaxDepsHook
+
+    pngquant
+    resvg
+  ];
+
+  # these two packages are just prebuilt wheels containing the respective binaries
+  pythonRemoveDeps = [ "pngquant-cli" "resvg-cli" ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    absl-py
+    fonttools
+    lxml
+    ninja-python
+    picosvg
+    pillow
+    regex
+    toml
+    tomlkit
+    ufo2ft
+    ufoLib2
+    zopfli
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+
+    ninja-python
+    picosvg
+  ];
+
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ pngquant resvg ]}"
+  ];
+
+  preCheck = ''
+    # make sure the built binaries (nanoemoji/maximum_color) can be found by the test
+    export PATH="$out/bin:$PATH"
+  '';
+
+  meta = with lib; {
+    description = "A wee tool to build color fonts";
+    homepage = "https://github.com/googlefonts/nanoemoji";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ _999eagle ];
+  };
+}
diff --git a/pkgs/tools/misc/nanoemoji/fix-test.patch b/pkgs/tools/misc/nanoemoji/fix-test.patch
new file mode 100644
index 000000000000..4582df9ea5b8
--- /dev/null
+++ b/pkgs/tools/misc/nanoemoji/fix-test.patch
@@ -0,0 +1,24 @@
+--- a/tests/proportional_cbdt.ttx
++++ b/tests/proportional_cbdt.ttx
+@@ -13,7 +13,7 @@
+     <mtx name=".notdef" width="0" lsb="5"/>
+     <mtx name=".space" width="0" lsb="0"/>
+     <mtx name="e000" width="110" lsb="0"/>
+-    <mtx name="e001" width="73" lsb="0"/>
++    <mtx name="e001" width="74" lsb="0"/>
+   </hmtx>
+ 
+   <cmap>
+@@ -79,10 +79,10 @@
+       <cbdt_bitmap_format_17 name="e001">
+         <SmallGlyphMetrics>
+           <height value="128"/>
+-          <width value="85"/>
++          <width value="86"/>
+           <BearingX value="0"/>
+           <BearingY value="104"/>
+-          <Advance value="85"/>
++          <Advance value="86"/>
+         </SmallGlyphMetrics>
+         <extfileimagedata value="e001.png"/>
+       </cbdt_bitmap_format_17>
diff --git a/pkgs/tools/misc/nanoemoji/test-pythonpath.patch b/pkgs/tools/misc/nanoemoji/test-pythonpath.patch
new file mode 100644
index 000000000000..12733224560c
--- /dev/null
+++ b/pkgs/tools/misc/nanoemoji/test-pythonpath.patch
@@ -0,0 +1,14 @@
+--- a/tests/test_helper.py
++++ b/tests/test_helper.py
+@@ -269,9 +269,9 @@
+     print("subprocess:", " ".join(cmd))  # very useful on failure
+     env = {
+         # We may need to find nanoemoji and other pip-installed cli tools
+-        "PATH": str(Path(shutil.which("nanoemoji")).parent),
++        "PATH": str(Path(shutil.which("nanoemoji")).parent) + ":" + os.environ["PATH"],
+         # We may need to find test modules
+-        "PYTHONPATH": os.pathsep.join((str(Path(__file__).parent),)),
++        "PYTHONPATH": os.pathsep.join((str(Path(__file__).parent),)) + ":" + os.environ["PYTHONPATH"],
+     }
+     # Needed for windows CI to function; ref https://github.com/appveyor/ci/issues/1995
+     if "SYSTEMROOT" in os.environ:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52e51a58c119..078253a87721 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1856,6 +1856,10 @@ with pkgs;
 
   sitespeed-io = callPackage ../tools/networking/sitespeed-io { };
 
+  slipstream = callPackage ../tools/games/slipstream {
+    jdk = jdk8;
+  };
+
   sorted-grep = callPackage ../tools/text/sorted-grep { };
 
   smb3-foundry = callPackage ../applications/misc/smb3-foundry { };
@@ -3122,6 +3126,8 @@ with pkgs;
 
   owl-lisp = callPackage ../development/compilers/owl-lisp { };
 
+  otus-lisp = callPackage ../development/compilers/otus-lisp { };
+
   ascii = callPackage ../tools/text/ascii { };
 
   asciinema = callPackage ../tools/misc/asciinema { };
@@ -9858,6 +9864,8 @@ with pkgs;
     pythonPackages = python3Packages;
   };
 
+  nanoemoji = python3Packages.callPackage ../tools/misc/nanoemoji { };
+
   nagelfar = callPackage ../development/tools/nagelfar { };
 
   nats-top = callPackage ../tools/system/nats-top { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 58ef196fe472..078a074dd7c1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7015,6 +7015,8 @@ self: super: with self; {
 
   nine = callPackage ../development/python-modules/nine { };
 
+  ninja-python = callPackage ../development/python-modules/ninja { };
+
   nipy = callPackage ../development/python-modules/nipy { };
 
   nipype = callPackage ../development/python-modules/nipype {
@@ -7875,6 +7877,8 @@ self: super: with self; {
 
   picos = callPackage ../development/python-modules/picos { };
 
+  picosvg = callPackage ../development/python-modules/picosvg { };
+
   piccolo-theme = callPackage ../development/python-modules/piccolo-theme { };
 
   pid = callPackage ../development/python-modules/pid { };
@@ -12996,6 +13000,8 @@ self: super: with self; {
 
   uc-micro-py = callPackage ../development/python-modules/uc-micro-py { };
 
+  ucsmsdk = callPackage ../development/python-modules/ucsmsdk { };
+
   udatetime = callPackage ../development/python-modules/udatetime { };
 
   ueberzug = callPackage ../development/python-modules/ueberzug {