diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 89442bbd33de..33ce50aedb2f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1768,6 +1768,15 @@
     githubId = 1222;
     name = "Aaron VonderHaar";
   };
+  aviallon = {
+    email = "antoine-nixos@lesviallon.fr";
+    github = "aviallon";
+    githubId = 7479436;
+    name = "Antoine Viallon";
+    keys = [{
+      fingerprint = "4AC4 A28D 7208 FC6F 2B51  5EA9 D126 B13A B555 E16F";
+    }];
+  };
   avitex = {
     email = "theavitex@gmail.com";
     github = "avitex";
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index bf2f5230c738..327d19daca30 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -583,7 +583,7 @@ in
           (lport: "sshd -G -T -C lport=${toString lport} -f ${sshconf} > /dev/null")
           cfg.ports}
         ${concatMapStringsSep "\n"
-          (la: "sshd -G -T -C laddr=${la.addr},lport=${toString la.port} -f ${sshconf} > /dev/null")
+          (la: "sshd -G -T -C ${escapeShellArg "laddr=${la.addr},lport=${toString la.port}"} -f ${sshconf} > /dev/null")
           cfg.listenAddresses}
         touch $out
       '')
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 752ab91fe631..b98cb5283a1a 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -182,7 +182,7 @@ in
         example = "770";
         description = lib.mdDoc ''
           If not `null`, is used as the permissions
-          set by `systemd.activationScripts.transmission-daemon`
+          set by `system.activationScripts.transmission-daemon`
           on the directories [](#opt-services.transmission.settings.download-dir),
           [](#opt-services.transmission.settings.incomplete-dir).
           and [](#opt-services.transmission.settings.watch-dir).
diff --git a/nixos/modules/tasks/filesystems.nix b/nixos/modules/tasks/filesystems.nix
index 7cb2ca23fa41..91e30aa4c0af 100644
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@@ -187,9 +187,8 @@ let
       skipCheck = fs: fs.noCheck || fs.device == "none" || builtins.elem fs.fsType fsToSkipCheck || isBindMount fs;
       # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
       escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
-    in fstabFileSystems: { rootPrefix ? "" }: concatMapStrings (fs:
-      (optionalString (isBindMount fs) (escape rootPrefix))
-      + (if fs.device != null then escape fs.device
+    in fstabFileSystems: { }: concatMapStrings (fs:
+      (if fs.device != null then escape fs.device
          else if fs.label != null then "/dev/disk/by-label/${escape fs.label}"
          else throw "No device specified for mount point ‘${fs.mountPoint}’.")
       + " " + escape fs.mountPoint
@@ -199,9 +198,7 @@ let
       + "\n"
     ) fstabFileSystems;
 
-    initrdFstab = pkgs.writeText "initrd-fstab" (makeFstabEntries (filter utils.fsNeededForBoot fileSystems) {
-      rootPrefix = "/sysroot";
-    });
+    initrdFstab = pkgs.writeText "initrd-fstab" (makeFstabEntries (filter utils.fsNeededForBoot fileSystems) { });
 
 in
 
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index d771ffd3e0f7..e88625678fec 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -57,7 +57,7 @@ in {
 
       {
         services.openssh = {
-          enable = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
+          enable = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } { addr = "[::]"; port = 22; } ];
           extraConfig = ''
             # Combined test for two (predictable) Match criterias
             Match LocalAddress 127.0.0.1 LocalPort 22
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 1a7eaf22ae05..d7ee8754c91c 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.118.7";
+  version = "3.118.8";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    hash = "sha256-e62Wn8rfjX5HmlA3+D6NkZNw2jzx1fYEHC9R1tioQhc=";
+    hash = "sha256-12R8g5U8p2lXNaSeJiCvEb6AgCC40jDXDKO8kyEvM6w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/pplite/default.nix b/pkgs/development/libraries/pplite/default.nix
new file mode 100644
index 000000000000..c9c0d1863382
--- /dev/null
+++ b/pkgs/development/libraries/pplite/default.nix
@@ -0,0 +1,19 @@
+{ stdenv, lib, fetchurl, flint, gmp }:
+
+stdenv.mkDerivation {
+  pname = "pplite";
+  version = "0.11";
+
+  src = fetchurl {
+    url = "https://github.com/ezaffanella/PPLite/raw/main/releases/pplite-0.11.tar.gz";
+    hash = "sha256-6IS5zVab8X+gnhK8/qbPH5FODFaG6vIsIG9TTEpfHEI=";
+  };
+
+  buildInputs = [ flint gmp ];
+
+  meta = {
+    homepage = "https://github.com/ezaffanella/PPLite";
+    description = "Convex polyhedra library for Abstract Interpretation";
+    license = lib.licenses.gpl3Only;
+  };
+}
diff --git a/pkgs/development/libraries/xgboost/default.nix b/pkgs/development/libraries/xgboost/default.nix
index 31d064c2af6d..49d042886b73 100644
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@@ -45,14 +45,14 @@ stdenv.mkDerivation rec {
   #   in \
   #   rWrapper.override{ packages = [ xgb ]; }"
   pname = lib.optionalString rLibrary "r-" + pnameBase;
-  version = "1.7.6";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "dmlc";
     repo = pnameBase;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-i7smd56rLbNY0qXysq818VYWYbjrnFbyIjQkIgf9aOs=";
+    hash = "sha256-HKITioCvBZHZWKFWwe9KbrFP+Nbz8adbZJvQiqApjUQ=";
   };
 
   nativeBuildInputs = [ cmake ]
@@ -144,6 +144,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dmlc/xgboost";
     license = licenses.asl20;
     platforms = platforms.unix;
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ abbradar nviets ];
   };
 }
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index 0cafac2c2d51..07153fb4bafd 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -106,6 +106,7 @@ mapAliases {
   inherit (pkgs) quicktype; # added 2023-09-09
   react-native-cli = throw "react-native-cli was removed because it was deprecated"; # added 2023-09-25
   inherit (pkgs) react-static; # added 2023-08-21
+  react-tools = throw "react-tools was removed because it was deprecated"; # added 2023-09-25
   readability-cli = pkgs.readability-cli; # Added 2023-06-12
   inherit (pkgs) redoc-cli; # added 2023-09-12
   reveal-md = pkgs.reveal-md; # added 2023-07-31
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index 6401df80940b..bac7c0780eab 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -52,7 +52,6 @@
   prettier = "prettier";
   purescript-psa = "psa";
   purs-tidy = "purs-tidy";
-  react-tools = "jsx";
   remod-cli = "remod";
   svelte-language-server = "svelteserver";
   teck-programmer = "teck-firmware-upgrade";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 9ae05ca5ae05..1e2305130de4 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -210,7 +210,6 @@
 , "purs-tidy"
 , "purty"
 , "pyright"
-, "react-tools"
 , "remod-cli"
 , "reveal.js"
 , "rimraf"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 63cead11ca78..ac630db67bf5 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -93737,60 +93737,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  react-tools = nodeEnv.buildNodePackage {
-    name = "react-tools";
-    packageName = "react-tools";
-    version = "0.13.3";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/react-tools/-/react-tools-0.13.3.tgz";
-      sha512 = "lmdjIRNk2cVUdlF/dyy6oP0nG2qrlX5qKFYRtiC5zK5Sg5QqgUEOrcS7Jz+kPNeOj9OWT7NfrR/cDvbGGSjCyg==";
-    };
-    dependencies = [
-      sources."acorn-5.7.4"
-      sources."amdefine-1.0.1"
-      sources."ast-types-0.9.6"
-      sources."balanced-match-1.0.2"
-      sources."base62-0.1.1"
-      sources."brace-expansion-1.1.11"
-      sources."commander-2.20.3"
-      sources."commoner-0.10.8"
-      sources."concat-map-0.0.1"
-      sources."defined-1.0.1"
-      sources."detective-4.7.1"
-      sources."esprima-3.1.3"
-      sources."esprima-fb-13001.1001.0-dev-harmony-fb"
-      sources."glob-5.0.15"
-      sources."graceful-fs-4.2.11"
-      sources."iconv-lite-0.4.24"
-      sources."inflight-1.0.6"
-      sources."inherits-2.0.4"
-      (sources."jstransform-10.1.0" // {
-        dependencies = [
-          sources."source-map-0.1.31"
-        ];
-      })
-      sources."minimatch-3.1.2"
-      sources."minimist-1.2.8"
-      sources."mkdirp-0.5.6"
-      sources."once-1.4.0"
-      sources."path-is-absolute-1.0.1"
-      sources."private-0.1.8"
-      sources."q-1.5.1"
-      sources."recast-0.11.23"
-      sources."safer-buffer-2.1.2"
-      sources."source-map-0.5.7"
-      sources."wrappy-1.0.2"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "A set of complementary tools to React, including the JSX transformer.";
-      homepage = "https://facebook.github.io/react";
-      license = "BSD-3-Clause";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   remod-cli = nodeEnv.buildNodePackage {
     name = "remod-cli";
     packageName = "remod-cli";
diff --git a/pkgs/development/ocaml-modules/apron/default.nix b/pkgs/development/ocaml-modules/apron/default.nix
index fddf128d0d9b..edf5ae9a4f33 100644
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@@ -1,26 +1,25 @@
 { stdenv, lib, fetchFromGitHub, perl, gmp, mpfr, ppl, ocaml, findlib, camlidl, mlgmpidl
-, gnumake42
+, flint, pplite
 }:
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-apron";
-  version = "0.9.13";
+  version = "0.9.14";
   src = fetchFromGitHub {
     owner = "antoinemine";
     repo = "apron";
     rev = "v${version}";
-    sha256 = "14ymjahqdxj26da8wik9d5dzlxn81b3z1iggdl7rn2nn06jy7lvy";
+    hash = "sha256-e8bSf0FPB6E3MFHHoSrE0x/6nrUStO+gOKxJ4LDHBi0=";
   };
 
-  # fails with make 4.4
-  nativeBuildInputs = [ ocaml findlib perl gnumake42 ];
-  buildInputs = [ gmp mpfr ppl camlidl ];
+  nativeBuildInputs = [ ocaml findlib perl ];
+  buildInputs = [ gmp mpfr ppl camlidl flint pplite ];
   propagatedBuildInputs = [ mlgmpidl ];
 
   # TODO: Doesn't produce the library correctly if true
   strictDeps = false;
 
-  outputs = [ "out" "bin" "dev" ];
+  outputs = [ "out" "dev" ];
 
   configurePhase = ''
     runHook preConfigure
@@ -32,8 +31,6 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $dev/lib
     mv $out/lib/ocaml $dev/lib/
-    mkdir -p $bin
-    mv $out/bin $bin/
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/dns-lexicon/default.nix b/pkgs/development/python-modules/dns-lexicon/default.nix
new file mode 100644
index 000000000000..bef030ca604d
--- /dev/null
+++ b/pkgs/development/python-modules/dns-lexicon/default.nix
@@ -0,0 +1,84 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, beautifulsoup4
+, cryptography
+, importlib-metadata
+, pyyaml
+, requests
+, tldextract
+, pytestCheckHook
+, pytest-vcr
+# Optional depedencies
+, boto3
+, localzone
+, softlayer
+, zeep
+, dnspython
+, oci
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "dns_lexicon";
+  version = "3.14.1";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "Analogj";
+    repo = "lexicon";
+    rev = "v${version}";
+    hash = "sha256-flK2G9mdUWMUACQPo6TqYZ388EacIqkq//tCzUS+Eo8=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-vcr
+  ] ++ passthru.optional-dependencies.full;
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    cryptography
+    importlib-metadata
+    pyyaml
+    requests
+    tldextract
+  ];
+
+  passthru.optional-dependencies = {
+    route53 = [ boto3 ];
+    localzone = [ localzone ];
+    softlayer = [ softlayer ];
+    ddns = [ dnspython ];
+    duckdns = [ dnspython ];
+    oci = [ oci ];
+    full = [ boto3 localzone softlayer zeep dnspython oci ];
+  };
+
+  pytestFlagsArray = [
+    "tests/"
+  ];
+
+  disabledTestPaths = [
+    # Needs network access
+    "tests/providers/test_auto.py"
+
+    # Needs network access (and an API token)
+    "tests/providers/test_namecheap.py"
+  ];
+
+  pythonImportsCheck = [
+    "lexicon"
+  ];
+
+  meta = with lib; {
+    description = "Manipulate DNS records on various DNS providers in a standardized way";
+    homepage = "https://github.com/AnalogJ/lexicon";
+    changelog = "https://github.com/AnalogJ/lexicon/blob/v${version}/CHANGELOG.md";
+    maintainers = with maintainers; [ aviallon ];
+    license = with licenses; [ mit ];
+  };
+
+}
diff --git a/pkgs/development/python-modules/pywlroots/default.nix b/pkgs/development/python-modules/pywlroots/default.nix
index 68a4753ba06d..78f64f1a3e5e 100644
--- a/pkgs/development/python-modules/pywlroots/default.nix
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@@ -20,19 +20,19 @@
 
 buildPythonPackage rec {
   pname = "pywlroots";
-  version = "0.15.24";
+  version = "0.16.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TvYhxiAbK+mpcEE9y79WH96dzeDnvI0xPaUxSYQqyHE=";
+    hash = "sha256-W43RCJektumgvO9K3K3mHR1BiyZXsHj4fN2EkGlJChQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   propagatedNativeBuildInputs = [ cffi ];
-  buildInputs = [ libinput libxkbcommon pixman xorg.libxcb udev wayland wlroots ];
+  buildInputs = [ libinput libxkbcommon pixman xorg.libxcb xorg.xcbutilwm udev wayland wlroots ];
   propagatedBuildInputs = [ cffi pywayland xkbcommon ];
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 1d8aaa55ba6e..dd45055c420d 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -5,13 +5,15 @@
 , dbus-next
 , dbus-python
 , glib
+, libdrm
 , libinput
 , libxkbcommon
 , mpd2
 , pango
+, pixman
 , pkg-config
 , psutil
-, pulseaudio
+, pulsectl-asyncio
 , pygobject3
 , python-dateutil
 , pywayland
@@ -22,19 +24,20 @@
 , wayland
 , wlroots
 , xcbutilcursor
+, xcbutilwm
 , xcffib
 , xkbcommon
 }:
 
 buildPythonPackage rec {
   pname = "qtile";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "qtile";
     repo = "qtile";
     rev = "v${version}";
-    hash = "sha256-HOyExVKOqZ4OeNM1/AiXQeiUV+EbSJLEjWEibm07ff8=";
+    hash = "sha256-WxnpkKqYGGEsFTt/1iCSiCzdESJP6HFJ6BztaMsMbYo=";
   };
 
   patches = [
@@ -48,6 +51,9 @@ buildPythonPackage rec {
       --replace libpango-1.0.so.0 ${pango.out}/lib/libpango-1.0.so.0
     substituteInPlace libqtile/backend/x11/xcursors.py \
       --replace libxcb-cursor.so.0 ${xcbutilcursor.out}/lib/libxcb-cursor.so.0
+    substituteInPlace libqtile/backend/wayland/cffi/build.py \
+        --replace /usr/include/pixman-1 ${lib.getDev pixman}/include \
+        --replace /usr/include/libdrm ${lib.getDev libdrm}/include/libdrm
   '';
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -66,12 +72,12 @@ buildPythonPackage rec {
     dbus-next
     mpd2
     psutil
+    pulsectl-asyncio
     pyxdg
     pygobject3
     pywayland
     pywlroots
     xkbcommon
-    pulseaudio
   ];
 
   buildInputs = [
@@ -79,6 +85,7 @@ buildPythonPackage rec {
     wayland
     wlroots
     libxkbcommon
+    xcbutilwm
   ];
 
   doCheck = false; # Requires X server #TODO this can be worked out with the existing NixOS testing infrastructure.
diff --git a/pkgs/development/python-modules/xgboost/default.nix b/pkgs/development/python-modules/xgboost/default.nix
index 5d0b3b561221..2a65992e048d 100644
--- a/pkgs/development/python-modules/xgboost/default.nix
+++ b/pkgs/development/python-modules/xgboost/default.nix
@@ -4,17 +4,19 @@
 , cmake
 , numpy
 , scipy
+, hatchling
 , stdenv
 , xgboost
 }:
 
 buildPythonPackage {
   pname = "xgboost";
+  format = "pyproject";
   inherit (xgboost) version src meta;
 
   disabled = pythonOlder "3.8";
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake hatchling ];
   buildInputs = [ xgboost ];
   propagatedBuildInputs = [ numpy scipy ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6a7bcbd77705..aac2f9604cfd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12215,6 +12215,8 @@ with pkgs;
 
   ppl = callPackage ../development/libraries/ppl { };
 
+  pplite = callPackage ../development/libraries/pplite { };
+
   ppp = callPackage ../tools/networking/ppp { };
 
   pptp = callPackage ../tools/networking/pptp { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a057296f0eb8..2c226bb06b5e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3140,6 +3140,8 @@ self: super: with self; {
 
   dnspython = callPackage ../development/python-modules/dnspython { };
 
+  dns-lexicon = callPackage ../development/python-modules/dns-lexicon { };
+
   doc8 = callPackage ../development/python-modules/doc8 { };
 
   docformatter = callPackage ../development/python-modules/docformatter { };
@@ -10934,7 +10936,7 @@ self: super: with self; {
   pywizlight = callPackage ../development/python-modules/pywizlight { };
 
   pywlroots = callPackage ../development/python-modules/pywlroots {
-    wlroots = pkgs.wlroots_0_15;
+    wlroots = pkgs.wlroots_0_16;
   };
 
   pyws66i = callPackage ../development/python-modules/pyws66i { };
@@ -11054,7 +11056,7 @@ self: super: with self; {
   qtconsole = callPackage ../development/python-modules/qtconsole { };
 
   qtile = callPackage ../development/python-modules/qtile {
-    wlroots = pkgs.wlroots_0_15;
+    wlroots = pkgs.wlroots_0_16;
   };
   qtile-extras = callPackage ../development/python-modules/qtile-extras { };